Splunk SOAR (f.k.a. Phantom)

Permissions issues after migrating to Unprivileged mode-How are we supposed to run unprivileged but complete admin tasks

kbuckle7
Observer

After updating to unprivileged mode (because privileged is being depcrecated), we are getting access denied issues when running some commands. For example: "phenv ibackup --setup"

So far, the issues seem to be with commands that relate to Postgres.

How are we supposed to run unprivileged, but complete admin tasks?

Note: If I run the commands as root, I get this error: "CommandError: This command must be executed by user phantom."

Thanks!

Labels (3)
0 Karma

phanTom
SplunkTrust
SplunkTrust

I have not seen this but I have also asked in the #SOAR community Slack channel.

I highly recommend signing up if not already: https://docs.splunk.com/Documentation/Community/current/community/Chat 

0 Karma

phanTom
SplunkTrust
SplunkTrust

@kbuckle7 sorry to hear you are having issuespost-conversion!

Have you engaged support yet??

What version are you? How did you convert? Did you use the migrate.py and it returned no issues/warnings?

Do all your directories under $PHANTOM_HOME now appear to be owned by Phantom?

If you have a support entitlement I would highly recommend raising this as a P2.

Tags (1)
0 Karma

kbuckle7
Observer

Thanks! I joined...

0 Karma

kbuckle7
Observer

Thanks for the quick reply!

We are on version 5.3.3 and ran the migrate.py script.

All directories in /opt/phantom are owned by phantom:phantom

I was hoping the community had seen this before opening a support ticket.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...