2.2 Securing Users and Passwords

2.2.1 Operating System Users

Server Installation

The Sentinel Log Manager server installation creates a novell system user and novell group that owns the installed files within the install_directory. The user’s home directory is set to /home/novell. By default, if a new user is created, the password for the user is not set in order to maximize security. If you want to log in to the system as the novell user, you must set a password for the user after installation.

Collector Manager Installation

Linux: The installer prompts you to specify the name of the system user who owns the installed files, as well as the location to create its home directory. By default, the system user is esecadm; however, you can change this system username. If the user does not exist, it is created along with its home directory. By default, if a new user is created, the password for the user is not set in order to maximize security. If you want to log in to the system as the user, you must set a password for the user after installation. The default group is esec.

During the client installation, if the user already exists, the installer does not prompt for the user again. This behavior is similar to the behavior during uninstallation or reinstallation of a software. However, you can have the installer prompt for the user again:

  1. Delete the user and group created at the time of first installation.

  2. Clear the ESEC_USER environment variables from the /etc/profile file.

Windows: No users are created.

The password policies for system users are defined by the operating system that is being used.

2.2.2 Sentinel Application and Database Users

All Sentinel Log Manager application users are native database users and their passwords are protected by the native database platform. These users have only read access to certain tables in the database so that they can execute queries against the database.

The admin user is the administrator user for Sentinel Log Manager user applications.

By default, the following database users are created during installation:

dbuser: The dbauser is created as a superuser who can manage the database and is typically the user who can log in to the pgAdmin. The password for the dbauser is accepted at the time of installation. This password is stored in the user home directory/.pgpass file. The system follows the PostgreSQL database password policies.

appuser: The appuser is the non-superuser used by Sentinel Log Manager to connect to the database. By default, the appuser uses a password randomly generated at installation, which is stored encrypted in the Install_Directory/server.xml file. To change the password for the appuser, use the Install_Directory/bin/dbconfig utility.

For more information, see Command Line Utilities.

NOTE:There is also a PostgreSQL database user that owns the entire database, including system database tables. By default, the postgres database user is set to NOLOGIN, so that no one can log-in as the PostgreSQL user.