Splunk needs a shell?

[daniel333]

All, 

Just noticed when Splunk UF installs it creates a user "splunk" with a login shell /bin/bash in /etc/passwd. 

e.g.
splunk:1007:/bin/bash

Is that needed? Can I switch it to a nologin? Anyone familiar with the impact of doing that? 

[edoardo_vicendo]

As of today on a CentOS 6 server we tested to modify the shell for splunk user from /bin/bash to /sbin/nologin

On this server it is running the Splunk Universal Forwarder.

After having modified the /etc/passwd file and restarted the Splunk Universal Forwarder it is still working, as well as the scripts directly launched by it.

#to modify the shell
usermod -s /sbin/nologin splunk

#to restart the Universal Forwarder
/etc/init.d/splunk restart

[isoutamo]

Personally I prefer to do it just like this. Disable login for splunk user w/o no real shell. And I do the same for both UF and other servers (like indexers, SHs etc.). When it's needed to run something on this user then use just sudo with used shell.

r. Ismo

[edoardo_vicendo]

I think it depends on how you manage your environment. We applied this modification only on a subset of client machines (having UF installed) because the side effect is that you are not able anymore to do "su - splunk".

On a UF it could be acceptable, mainly because you deploy the apps with the Splunk Deployment Server, and because to restart the UF if needed you can leverage on init or systemd. 

On the other hand, if you are on a Splunk server (having Splunk Enterprise installed), it is usually necessary to become splunk user to modify configuration files, run CLI commands etc... Of course you can also manage it adding requested commands in sudoers file, but it could take time to define them all, and using wildcards on sudoers file it's not the best choice in term of security. This obviously applies unless you are not root on that machine 🙂

[isoutamo]

You could do sudo -u splunk /bin/bash to get shell and after that works (almost) like after su splunk (w/o - ).