Is it possible to limit use of Splunk native user "admin" from command line?

[mlevsh]

We are running Splunk Enterprise 6.3.3 (we are planning to update to 6.5.0 soon).
Due to a security reason, we need to limit as much as possible the use of native Splunk user "admin". Is it possible?
We are using different IDs mapped to admin role on Splunk web interface.
But still need to use admin user for running Splunk commands from command line directly on server (Linux).

Thank you

[pgreer_splunk]

This is all that I know of - setting in the server.conf:

# The following 'allowRemoteLogin' setting controls remote management of your splunk instance.
#  - If set to 'always', all remote logins are allowed.
#  - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow
#    remote management through splunkweb if splunkweb is on the same server.
#  - If set to 'requireSetPassword' (default behavior):
#     1. In the free license, remote login is disabled.
#     2. In the pro license, remote login is only disabled for the admin user that has not changed their default password
allowRemoteLogin=requireSetPassword

So basically no - you can disable wholesale or enable wholesale. I don't see a way to just disable CLI for admin only while still allowing other Splunk users the ability to access via CLI.

[martin_mueller]

I'd start with looking at the messages in _internal regarding the failed authentication, e.g. "did the ldap/ad connection work?"

[mlevsh]

@martin_mueller, we tried to use AD-mapped accounts with admin role on the command line and it didn't work for us. Any idea what might be the reason?

[martin_mueller]

You can use LDAP-/AD-mapped accounts on the command line.

[mlevsh]

Thank you @pgreer for your reply.
I'm not sure I understand though. The question wasn't about remote login or access via CLI.
Some splunk commands require admin authentication when invoked from command line, for example
"splunk apply ".
It seems that we can use only native splunk local "admin" account then and cannot use our AD accounts that we use to administrate Splunk via Web Interface.