topic Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399 in Cortex XSOAR Discussions

Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

assubramania — Mon, 29 Apr 2024 02:38:57 GMT

Unable to read the file via remote access with service account Cortex XSOAR ID: 4893410215349833399 We created a service account with /usr/sbin/nologin in /etc/passwd but was unable to read the file in /home directory. However, we managed to read it upon changing it to /bin/bash in the said file. Kindly advise if we can read/write the file in UNIX server using the service account.

Running a ssh command with 'ls' using the integration https://cortex.marketplace.pan.dev/marketplace/details/RemoteAccess/

Re: Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

kkrumenacker — Mon, 03 Jun 2024 16:18:28 GMT

If I understand correctly, nologin is essentially making the user's account disabled and prevents them from logging in. https://manpages.ubuntu.com/manpages/bionic/man5/nologin.5.html The account you use with this integration would need to be able to ssh in. If you would try to ssh into the user account you created with /usr/sbin/nologin, I would expect you couldn't login.

Re: Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

jfernandes1 — Tue, 04 Jun 2024 01:36:47 GMT

Hi @assubramania, I think this might be an OS permission issue. Not sure we can help with that here. I would circle back with your Linux admin for recommendation on the service account.