Deployment Architecture

Access Control Within DBConnect (DBX)

jodros
Builder

Does anyone know how to accomplish this? I have tried utilizing the "Restrict search terms" but it is not working. Currently if I allow a user access to DBX they would see all database connections.

Any ideas would be appreciated.

Thanks

0 Karma
1 Solution

jodros
Builder

This issue has been corrected with the recent update for dbx.

View solution in original post

0 Karma

jodros
Builder

This issue has been corrected with the recent update for dbx.

0 Karma

Dan
Splunk Employee
Splunk Employee

We just added a topic in the documentation called "Security and access controls" http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Securityandaccesscontrols

In Splunk DB Connect versions 1.0.8 and earlier, database connection objects cannot be restricted to a particular role. When creating a database connection, the credentials you use will be implicitly used by every user that has access to dbquery, dblookup, or any other commands that use the connection. For instance, dbquery myConnection "SELECT * FROM Audit_Table" will not check whether the executing user has rights to the myConnection object. You can, however, limit which roles have access to the dbquery command. By default, only admins have access to dbquery, dblookup, and dboutput commands.

Make sure you use a database account with appropriately limited permissions. The recommended solution to work with databases regarding security (both read-only and read-write), is to limit the permissions of the database user, specified in the database connection, to the minimum necessary to fulfil its tasks. i.e. the user should only have read access (SELECT) to required tables/views. In case of dboutput the user should be granted limited write access as well (INSERT, UPDATE). This configuration needs to be done on the DBMS side - so describing the necessary steps for each DBMS type is out of scope for these docs.

An additional mitigation is to configure the database connection as read-only.
0 Karma

Dan
Splunk Employee
Splunk Employee

We are working on role-based permissions for database connections. I will update when that is released, but it will not be before July.

0 Karma

jodros
Builder

This would not accommodate what we need. The only way I can think to currently accomplish our needs is to have separate search heads for different user access within DBX, which isn't optimal. I would love to be able to assign roles to database connections or be able to utilize the restrict search terms to prevent unauthorized access to databases.

Thanks

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...