Remove Sguil User

[TJ]

Hello,
Can anyone tell me how to remove or disable a Sguil user?

Thanks!

[Doug Burks]

Hi TJ,

You probably don't want to remove a Sguil user since it may have
entries in the Sguil database. Instead, reset the user's password to
a random password that nobody knows:
sudo nsm_server_user-passwd

> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.



--
Doug Burks
Need Security Onion Training or Commercial Support?
http://securityonionsolutions.com

[TJ]

Is there a "disabled" state or similar? I've got auditors that are not satisfied with the account of an inactive employee being active.

I did the password change.

Thanks
Tim

[Bamm Visscher]

Disabling of the user ID is supported via:

./sguild -disableuser <username>

This marks the account as LOCKED and prevents the user from logging in. The user information remains in the database in order to maintain a proper history of activity performed by the user.

Bamm

--
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at http://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

--

sguil - The Analyst Console for NSM
http://www.sguil.net

[Doug Burks]

Thanks, Bamm!

I've added the following to the Passwords page on our Wiki:

Disable accounts with "sudo sguild -disableuser USER" (replacing USER
with the actual username you'd like to disable).

https://github.com/Security-Onion-Solutions/security-onion/wiki/Passwords#sguil