Security

Splunk needs a shell?

daniel333
Builder

All, 

Just noticed when Splunk UF installs it creates a user "splunk" with a login shell /bin/bash in /etc/passwd. 

e.g.
splunk:1007:/bin/bash

Is that needed? Can I switch it to a nologin? Anyone familiar with the impact of doing that? 

Labels (1)
0 Karma

edoardo_vicendo
Contributor

As of today on a CentOS 6 server we tested to modify the shell for splunk user from /bin/bash to /sbin/nologin

On this server it is running the Splunk Universal Forwarder.

After having modified the /etc/passwd file and restarted the Splunk Universal Forwarder it is still working, as well as the scripts directly launched by it.

#to modify the shell
usermod -s /sbin/nologin splunk

#to restart the Universal Forwarder
/etc/init.d/splunk restart

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Personally I prefer to do it just like this. Disable login for splunk user w/o no real shell. And I do the same for both UF and other servers (like indexers, SHs etc.). When it's needed to run something on this user then use just sudo with used shell.

r. Ismo

0 Karma

edoardo_vicendo
Contributor

I think it depends on how you manage your environment. We applied this modification only on a subset of client machines (having UF installed) because the side effect is that you are not able anymore to do "su - splunk".

On a UF it could be acceptable, mainly because you deploy the apps with the Splunk Deployment Server, and because to restart the UF if needed you can leverage on init or systemd. 

On the other hand, if you are on a Splunk server (having Splunk Enterprise installed), it is usually necessary to become splunk user to modify configuration files, run CLI commands etc... Of course you can also manage it adding requested commands in sudoers file, but it could take time to define them all, and using wildcards on sudoers file it's not the best choice in term of security. This obviously applies unless you are not root on that machine 🙂

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You could do sudo -u splunk /bin/bash to get shell and after that works (almost) like after su splunk (w/o - ).
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!