Splunk Enterprise

Splunk Installation running as non-root user (Debian package)

IAskALotOfQs
Explorer

I have installed Splunk Enterprise free trial into a VM as a root user. I know the best practice is to avoid using root to run as Splunk in case the underlying OS gets compromised and then the hacker has access to your OS with root level.

I am following the doc online and it says once you install Splunk as root, don't start the Splunk installation but rather add a new user and then change ownership of the Splunk folder to that new non-root user

 

But before I do that, when Splunk is installed I check its ownership and it's already configured to Splunk. Does this mean Splunk has already configured a non-root user automatically upon installation?

 

If so, how would I make sure it has read access to local files I want to monitor?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

when you are using package manager like yum or dpkg, the installation add user splunk and change ownership of files to that user.

To give access to local files you could grant access by setfacl per file or recursively by directory.

r. Ismo

richgalloway
SplunkTrust
SplunkTrust

If you use an installer (as opposed to expanding a tarball) then the user was created for you and all files were given to that user.

To be able to read local files, check out this document: https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Installleastprivileged . It's written for forwarders, but may work for Splunk Enterprise, as well.  If it doesn't work then you'll need to change file permissions or add user 'splunk' to a group that has read access to the file(s).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...