Installation

Can I Install Splunk Enterprise as a non-root user, run Splunk Enterprise as a non-root user, as well as listen directly on a port below 1024?

wellchai0914
New Member

Can I Install Splunk Enterprise as a non-root user, run Splunk Enterprise as a non-root user, as well as listen directly on a port below 1024?

Tags (1)
0 Karma

wellkitkit
Engager

May I know if I can use the setcap to solve non-root user listening to a port below 1024 as below

setcap cap_net_bind_service=ep /opt/splunk/bin/splunkd

gjanders
SplunkTrust
SplunkTrust

From a Unix OS point of view no, you cannot be non-root and listen to a port below 1024

You can use various tricks such as port re-direction to work around this, but a better question is what problem are you trying to solve?
If you need a UDP or TCP listener on a port below 1024 you might want to have a look at syslogNG, I have a post on it here

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!