Security

How to change the user Splunk runs scripts as?

Myelin
Explorer

We've been using the functionality in Splunk to have it kick off a script when certain search criteria is met. However, we noticed Splunk is executing those scripts as root. How can we change the user it runs scripts as? Note, that Splunk itself is not running from the root user, but a Splunk user.

0 Karma

lycollicott
Motivator

If your scripts run as root then modify your scripts to "su - desired_user -c commands".

There are actually two ways to go about that.

If your script is short and has let's say one command in it to run as another user then you could change this:

some_command_or_script_to_run

to this:

su - desired_user -c some_command_or_script_to_run

Or if your script is quite long with many different commands in it then you could make a wrapper script that had a line in it like this:

su - desired_user -c that_long_script_ with_too_many_lines_to_edit
0 Karma

LewisWheeler
Communicator

Splunk should be running scripts as the user which splunkd runs as as far as I am aware - do you have the scripts in the $SPLUNK_HOME/bin/scripts directory? or are they part of a custom app?

What sort of scripts are we talking about? Shell, VBS, Powershell?

0 Karma

Myelin
Explorer

The scripts are in fact in the $SPLUNK_HOME/bin/scripts directory and these are shell scripts.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...