Service account dictionary
Two source networks tried sonar, hadoop, and esuser credentials in sequence against the honeypot, both succeeding on esuser. All three are factory defaults: SonarQube ships sonar, Apache Hadoop ships hadoop, and Elasticsearch ships esuser.
Two logins, three service accounts: Elasticsearch, SonarQube, Hadoop.
Most credential guessing is root and admin with short passwords. These two source networks brought a different list.
Source one tried sonar colon sonar — the SonarQube developer account, the default on a fresh install. It failed. Then esuser colon esuser, the Elasticsearch default. That worked. Source two tried hadoop colon hadoop, the Apache Hadoop default, then fell back to esuser. That worked too.
No generic passwords, no number suffixes, no variations. Two independent networks, the same purpose-built dictionary, both converging on esuser as the credential that wins.
A default service account for an internal tool is as exposed as root, if the host is internet-reachable.
Check every service you run for a factory default credential.
#linux#security#ssh#passwords#sysadmin
❯ Check every service you run for a factory default credential.