Security

How to change the user Splunk runs scripts as?

Explorer

We've been using the functionality in Splunk to have it kick off a script when certain search criteria is met. However, we noticed Splunk is executing those scripts as root. How can we change the user it runs scripts as? Note, that Splunk itself is not running from the root user, but a Splunk user.

0 Karma

Motivator

If your scripts run as root then modify your scripts to "su - desired_user -c commands".

There are actually two ways to go about that.

If your script is short and has let's say one command in it to run as another user then you could change this:

some_command_or_script_to_run

to this:

su - desired_user -c some_command_or_script_to_run

Or if your script is quite long with many different commands in it then you could make a wrapper script that had a line in it like this:

su - desired_user -c that_long_script_ with_too_many_lines_to_edit
0 Karma

Communicator

Splunk should be running scripts as the user which splunkd runs as as far as I am aware - do you have the scripts in the $SPLUNK_HOME/bin/scripts directory? or are they part of a custom app?

What sort of scripts are we talking about? Shell, VBS, Powershell?

0 Karma

Explorer

The scripts are in fact in the $SPLUNK_HOME/bin/scripts directory and these are shell scripts.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!