Security

How do I change the user Splunk runs as?

Bill_B
Communicator

I have installed Splunk 6.0.4 as a root user on Linux 64bit RH 6.4. However, now I would like to change the user Splunk runs as to a non-root user. Is this possible and how would it be done?

-Thanks!

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are two basic things that need to happen here

1) Change the ownership, recursively, of the splunk_home to the new user : chown -R newuser:newgroup /opt/splunk

2) Change the user Splunk starts as. You can do this by editing the launch.conf, or more easily with

$splunk_home$/bin/splunk enable boot-start -user newuser

Change newuser to the new username.

joelby
Explorer

I eventually used strace to figure out how Splunk was determining the user to run as. Have a look in $SPLUNK_HOME/etc/splunk-launch.conf - there's a SPLUNK_OS_USER= configuration option, which you'll probably want to set to the user that owns the files.

ChrisG
Splunk Employee
Splunk Employee

This is documented in the Installation Manual topic, Run Splunk Enterprise as a different or non-root user.

0 Karma

Bill_B
Communicator

Yes. Documentation says, "before you start Splunk Enterprise for the first time, change the ownership of the $SPLUNK_HOME directory to the desired user."
But Splunk was started as root-user and has been running as root-user. So will the "chown" command work after Splunk was started and running as root-user?

0 Karma

Marc785
Explorer

Hi!

What has worked for me, especially when I would run into permission issues early in my splunking career, is to follow the steps listed above, but then add the following touches (assuming splunk is the user you want to use):

sudo $SPLUNK_HOME/bin/splunk stop (no need to have splunkd cling to files/process that retain the previous ownership)

sudo su splunk

sudo chown -R splunk:splunk /opt/splunk(or where ever splunk is installed)

sudo $SPLUNK_HOME/bin/splunk start

Let splunk run through it's initialization process and BAM! Splunk is running as the new user, all of the ownership should be changed recursively throughout the file structure, and you've removed the need to reindex data or run chown multiple times. Hopefully this works with the same magical flair for you as it has for me. But you have shout "Bam!" with an exaggerated motion or else you break the magic. 🙂 happy splunking, my friend.

malmoore
Splunk Employee
Splunk Employee

Hi, this particular stipulation predates my time here.

The fast fix is to reinstall Splunk and reindex.

That said, I have performed chowns on existing Splunk installations that have initially been started and run as root without issue.

You might need to perform the chown multiple times before it takes, and it's possible that a chown -R from the top of the directory won't always take. I think this is why the stipulation exists.

Bill_B
Communicator

Thank you all for your input.

0 Karma

sanjay_shrestha
Contributor

You can use:
chown -R group:user SPLUNK_HOME

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...