6

I am the Splunk administrator working with an Ubuntu 12.04 LTS system and I want to collect events from /var/log/auth.log.

-rw-r----- 1 root adm 16534643 Jan  8 09:49 /var/log/auth.log

Splunk runs as a normal user, splunk.

$ id splunk
uid=1984(splunk) gid=1984(splunk) groups=1984(splunk)

Normally, I'd use this command so make the file group readable by the splunk group.

$ chgrp splunk /var/log/auth.log
-rw-r----- 1 root splunk 16534643 Jan  8 09:49 /var/log/auth.log

This works fine on other Linux distros and I assume this is okay with Ubuntu as well. But I do want to ask, will bumping out the adm cause me (actually, the other group that owns the box) headaches in the future? I am not a privileged user on the system, so I cannot check things like /var/log/cron/adm or mail for the adm account. I'm also assuming that logrotate will honor my new group owner for new files.

(Before you ask, access to the splunk index for auth.log is restricted to a limited number of people.)

  • Why do you want to change the group ownership rather than changing the read permissions? – jobin Jan 8 '14 at 16:33
  • 2
    wouldn't it make more sense to add the splunk user to the adm group? – steeldriver Jan 8 '14 at 16:59
  • steeldriver, I'm trying to keep splunk as non-privileged as I can. What other baggage comes with adding splunk to the adm group? (This is a possible solution, though.) – IAmJeff Jan 8 '14 at 18:35
  • Jobin, I do not want to grant everyone permission to read this log file. – IAmJeff Jan 8 '14 at 21:31
2

Followup: Since no one ever gave a reason why "adm" group ownership was important, I changed the group ownership to "splunk".

After 6 months, no issues were noticed. I decided against giving the splunk user additional group privileges by adding it to the "adm" group. I reasoned I could give the adm account the extra privilege of "splunk" group membership, if necessary.

1

adm group may be important IF a security tool such as AppArmor (see https://wiki.ubuntu.com/AppArmor) is being used for additional security.

I mention this only because I ran into strange problems (access failures) when trying to configure bind on ubuntu and using different directories. That is, bind refused to work with changes that made sense to me but were not the AppArmor defaults. As I did not want to reconfigure AppArmor I went back to it's defaults - and sudo su when I need to make changes. For a single user system this is okay, but I would not want it this way in a production system.

Lastly, adm group may be important if you are audited - i.e., an auditor may consider it a breach of system integrity if it is not group adm. A way you might be able to 'pass' with is using ACLs (Access Control Lists) - see https://help.ubuntu.com/community/FilePermissions#ACL_.28Access_Control_List.29 for more info on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.