Closed dougburks closed 3 years ago
the following users have been prohibited: root bin daemon adm lp sync shutdown halt mail operator games ftp nobody systemd-network dbus polkitd sshd postfix chrony socore soremote ntp tcpdump elasticsearch stenographer suricata zeek curator kratos kibana elastalert ossecm ossecr ossec logstash
Setup prompts the user to specify a username for their administrative account. We should check this input and make sure they are not specifying
root
or some other pre-existing account.Reference: https://groups.google.com/u/1/g/security-onion/c/Y31lfIk_OKQ