Questions about the onion account

[thomas-rocheteau]

Hello,

I installed a Security Onion in Standalone mode, and I noticed that an account called ‘onion’ was connecting via ssh and executing the sudo command.
Do you know if this is a system account, or simply why I'm seeing this?

Thanks

[dougburks]

Where exactly are you seeing this?

Are you able to provide the full log?

[thomas-rocheteau]

Hello,

Thank you for your reply.

I am seeing this in the Alerts and Hunt tabs:

I don't have any logs to show you, do you have a suggestion where to look for logs related to this?

[thomas-rocheteau]

I don't think it is necessary for you to help me investigate, I simply looked to see if the "onion" account was part of the SecurityOnion tool as I couldn't find the information online.
Thank you for your interest, but I just need to know if the "onion" account is part of the default tool?

[dougburks]

We don't automatically create an onion account.

Is it possible that you created an onion account?

It most likely would have been at the very beginning of the installation process as shown in the screenshot below (which is the second screenshot at https://docs.securityonion.net/en/2.4/first-time-users.html):

[thomas-rocheteau]

Thanks for your help, it solves my problem!