ChrisYounger
Granular permissions
Up until now, I've just been directly editing config files on the server through the administrative SMB share. I want any kind of Splunk operation to be run through Splunk web, and this app is a big step in the right direction. However, I notice it's either "all can write" or "none can write":
As a matter of fact, because this app allows changing files just like you are on the filesystem, it should be used very carefully in any environment that you care about.
Are there any plans to impose more granular permissions, like attached to Splunk roles? Things like:
- Only certain roles can write.
- Only certain roles can use this specific home command.
Thankfully for now, it's just been me for managing Splunk. But if things were to grow (such as in a larger environment), this would be crucial. Using this app allows me to avoid giving shell access (RDP/SSH) and/or SMB directory access.
Hi Tyler, This is a very hard problem to solve in a secure way. As soon as you allow a user to be able to write to any file, they could potentially hack the system (they could create a shell script that creates a new Splunk admin user) and then execute that script by changing inputs.conf.
Ill take a another look at this problem soon and see if something can be done.
All the best
