Deployment Architecture

How to assign a password to the Universal Forwarder to prevent it from being uninstalled?

edgarsilva01
Path Finder

Hello everyone,

Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?

or what options do i have?

Thanks

Regards

Labels (1)
0 Karma

lloydknight
Builder

Hello @edgarsilva01

I believe the question is more on user's operating system rights/permission to modify the UF.

As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.

Linux:
Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser

Windows:
Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.

Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.

https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Hope it helps!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...