Website Maintenance User Account

After upgrading to 2022.3 i noticed a local orion account name WebSiteMaintenance_User_randomnumberstring

I wasn't able to find any information on this new account in the release notes or anywhere online, but found a website maintenance log file that reflects this account is updated every night during website maintenance, looks like the number string is changed, password is changed, the account is enabled, and then it is disabled nightly during maintenance. As far as i can tell the purpose of this account is to time the webpage render.

Its just odd to me there is zero mention of this account and its requirements or role in any SolarWinds documentation. Its also odd that they go through the trouble of renaming, updating the password, and enabling/disabling the account rather than just deleting and re-creating it nightly to avoid concerns about a mysterious account showing up. This could raise some red flags with security audits and things like that.

Find more posts tagged with

Accepted answers

All comments

sguido

This will cause a security red flag in my environment as well. I'll need some type of official documentation about the purpose of this account.

sbiederm

Has this been addressed anywhere? I've noticed this as well since I updated to 2022.3. I even deleted the account, and it just comes back. I haven't been able to find any info about why this account exists.

GavinC

I have noticed this also after an upgrade to 2022.3 and have not been able to find any form of documentation or patch notes to advise what this actually is. If anyone finds out, please document it here!

sbiederm

After opening a support case regarding this, this is the answer I received from SolarWinds Technical Support. Hope this helps.

WebsiteMaintenance_user is a non-administrator account with no privileges. It is created automatically to speed up starting the website when accessing the Orion Web Console for the first time after restarting the server or running the Configuration Wizard.
It is a new added feature by the new version and we don't advise removing it. Please ignore it as it has its use to speed up the console.

GavinC

Many thanks for taking the time to look into this @sbiederm

cmatrask

We don't like applications creating their own UserIDs, with all the vulnerbilities we are experiencing.
I was asked to remove the Website Maintenance ID and I did as asked.
It was removed.
And the "All Nodes" widget is not functioning and is not sorting as it was set up as.

We really should have been informed about the Website Maintenance account being created.
This not bode too well for our Network Security group. This ID will need to be accounted for, to them (transparency).

Thanks much,

Cheryl

msites

I agree. They have been hiding a lot of issues in their release notes and not being transparent recently. They knew about a major bug in 2022.4 that causes SWIS to fail causing customers to be down, they never pulled the release or provided notice in the release notes for "Known issues". Our security team noticed this account in 2022.3 during an audit and support was unable to provide a valid reason why a product was creating its own account.

acurrent

Indeed, i agree. Additionally, we found a major security issue in 2022.4, SW support claims it is fixed in the 2022.4.1 HF, though there is no mention at all of this issue in the release notes.

I will say i did experience that SWIS failure issue as well just last night, looks like the information service initiated a restart of plugins, when they were restarting, they couldn't connect to SWIS so my polling engine was down until manual intervention. This does appear to be addressed in the release notes.
Article Detail (solarwinds.com)