Security

Is it possible to limit use of Splunk native user "admin" from command line?

mlevsh
Builder

We are running Splunk Enterprise 6.3.3 (we are planning to update to 6.5.0 soon).
Due to a security reason, we need to limit as much as possible the use of native Splunk user "admin". Is it possible?
We are using different IDs mapped to admin role on Splunk web interface.
But still need to use admin user for running Splunk commands from command line directly on server (Linux).

Thank you

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

This is all that I know of - setting in the server.conf:

# The following 'allowRemoteLogin' setting controls remote management of your splunk instance.
#  - If set to 'always', all remote logins are allowed.
#  - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow
#    remote management through splunkweb if splunkweb is on the same server.
#  - If set to 'requireSetPassword' (default behavior):
#     1. In the free license, remote login is disabled.
#     2. In the pro license, remote login is only disabled for the admin user that has not changed their default password
allowRemoteLogin=requireSetPassword

So basically no - you can disable wholesale or enable wholesale. I don't see a way to just disable CLI for admin only while still allowing other Splunk users the ability to access via CLI.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd start with looking at the messages in _internal regarding the failed authentication, e.g. "did the ldap/ad connection work?"

0 Karma

mlevsh
Builder

@martin_mueller, we tried to use AD-mapped accounts with admin role on the command line and it didn't work for us. Any idea what might be the reason?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use LDAP-/AD-mapped accounts on the command line.

0 Karma

mlevsh
Builder

Thank you @pgreer for your reply.
I'm not sure I understand though. The question wasn't about remote login or access via CLI.
Some splunk commands require admin authentication when invoked from command line, for example
"splunk apply ".
It seems that we can use only native splunk local "admin" account then and cannot use our AD accounts that we use to administrate Splunk via Web Interface.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...