Default users RHEL

An overview of the default user profiles that created during a clean platform installation.

The installation procedure creates several default user profiles at platform level, as well as at host system level, to access and manage third-party components and processes. These users receive a standard set of user rights and permissions to allow them to carry out their tasks.

They interact only with the component(s) they manage and control. These users and groups are organized in separate compartments, where each user is responsible for one or more specific, and closely related, tasks.

User	Group	Sudo	Component	Description	Home dir
root	root	# Root-access login shell sudo -i	Celery workers and task runners, graph ingestion, intel ingestion, search ingestion.	Platform user responsible for operational tasks like accessing Celery tasks, writing data to the graph ingestion storage location, and accessing the TAXII service. root:eclecticiq owns the following platform configuration files: opentaxii.yml platform_settings.py proxy_url	/root
eclecticiq	eclecticiq	sudo -u eclecticiq	Platform configuration files. eiq-platform platform command line utility.	The eclecticiq user: Cannot log in from the terminal. Does not have a shell. Prepend it as sudo user to commands that must run under the eclecticiq user.	/home/eclecticiq
elasticsearch	elasticsearch	su -s /bin/bash elasticsearch	Elasticsearch search and indexing database.	Search and indexing database user.	/var/lib/elasticsearch
logstash	logstash	sudo -i -u logstash	Logstash log aggregator.	Log aggregator user.	/usr/share/logstash
nginx	nginx	sudo -i -u nginx	Nginx web server.	Web server user and group.	/var/cache/nginx
postgres	postgres	sudo -i -u postgres	PostgreSQL database.	Database user, can access the default platform database. To start a PostgreSQL shell as a super user with root-level access: sudo -u postgres psql	/var/lib/pgsql
redis	redis	sudo -i -u redis	Redis server, message broker and queue manager.	Redis database and message broker user.	/var/lib/redis
kibana	kibana	sudo -i -u kibana	Kibana	Kibana, a data visualization component for Elasticsearch.	/home/kibana