Splunk local account SOX compliance

[LOP22456]

Hello,

I have a request from a systems manager related to SOX controls. They are requesting information around the local Splunk account that is created when a UF is being installed (this is on a Linux machine). They are asking where the password is stored for this account/who has access to it, and what are the controls around it.

They are requesting to make this account non-interactive - would this cause any problems? They would then have to go around to all 200+ UFs and do this, not sure how intuitive this would be.

Has anyone encountered requests related to local Splunk UF accounts & SOX controls?

[livehybrid · Accepted solution]

Hi @LOP22456 

The user (typically splunkfwd) that is created is a standard system user, so will be stored in /etc/passwd with other local users and I dont think a password is set, so its not possible to login with the user. The password would be stored in /etc/shadow if set.

Check out https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Installanixuniversalforwarder#:~:te... for more information around this if you havent already seen.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[LOP22456]

Thank you, this is exactly what I need.