Installation

Can I Install Splunk Enterprise as a non-root user, run Splunk Enterprise as a non-root user, as well as listen directly on a port below 1024?

wellchai0914
New Member

Can I Install Splunk Enterprise as a non-root user, run Splunk Enterprise as a non-root user, as well as listen directly on a port below 1024?

Tags (1)
0 Karma

wellkitkit
Engager

May I know if I can use the setcap to solve non-root user listening to a port below 1024 as below

setcap cap_net_bind_service=ep /opt/splunk/bin/splunkd

gjanders
SplunkTrust
SplunkTrust

From a Unix OS point of view no, you cannot be non-root and listen to a port below 1024

You can use various tricks such as port re-direction to work around this, but a better question is what problem are you trying to solve?
If you need a UDP or TCP listener on a port below 1024 you might want to have a look at syslogNG, I have a post on it here

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...