Security Onion default account

[Éric Marcoux]

Hello,

I have a simple question for you guys. When I run this command :

mysql -uroot -Dsecurityonion_db -e "select * from user_info;"

I get a list of the users that can access Squert, Squil and ELSA. In this list I see the account "onionuser" that I have disabled, my account and also an account named "auto" with "NULL" password. I was wondering what does it do? Also can I disable this account?

Best regards
Eric

[Wes]

Eric,

I believe the "auto" account (Doug, please correct me if I am wrong) is used when the securityonion_db database is first created/configured. I'm not sure if disabling it would affect anything, as I have not tried myself, but I would assume that it would not be used again unless you re-ran setup or re-configured securityonion_db again.

Doug, would you be able to provide a little more insight?

Thanks,
Wes

[Doug Burks]

The "auto" account is used for autocat functionality. Since the
password is set to NULL, nobody should be able to logon with that
account.

> --
> Follow Security Onion on Twitter!
> https://twitter.com/securityonion
> ---
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at https://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.



--
Doug Burks

[Wes Lambert]

That was my other guess! :)

On Oct 27, 2016 5:40 PM, "Doug Burks" <doug....@gmail.com> wrote:

The "auto" account is used for autocat functionality.  Since the
password is set to NULL, nobody should be able to logon with that
account.

On Thu, Oct 27, 2016 at 3:54 PM, Wes <wlamb...@gmail.com> wrote:
> On Thursday, October 27, 2016 at 3:02:47 PM UTC-4, Éric Marcoux wrote:
>> Hello,
>>
>> I have a simple question for you guys. When I run this command :
>>
>> mysql -uroot -Dsecurityonion_db -e "select * from user_info;"
>>
>> I get a list of the users that can access Squert, Squil and ELSA. In this list I see the account "onionuser" that I have disabled, my account and also an account named "auto" with "NULL" password. I was wondering what does it do? Also can I disable this account?
>>
>> Best regards
>> Eric
>
> Eric,
>
> I believe the "auto" account (Doug, please correct me if I am wrong) is used when the securityonion_db database is first created/configured.  I'm not sure if disabling it would affect anything, as I have not tried myself, but I would assume that it would not be used again unless you re-ran setup or re-configured securityonion_db again.
>
> Doug, would you be able to provide a little more insight?
>
> Thanks,
> Wes
>
> --
> Follow Security Onion on Twitter!
> https://twitter.com/securityonion
> ---
> You received this message because you are subscribed to the Google Groups "security-onion" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
> To post to this group, send email to security-onion@googlegroups.com.

> Visit this group at https://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.



--
Doug Burks

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.

To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.

[Éric Marcoux]

Thank you guys, good to know.