(SOLVED) [appuser] 127.0.0.1 question please

[Skwor]

Simple question, is [appuser] from 127.0.0.1 a normal login for some QNAP apps?

appuser Snipaste_2021-04-04_08-02-19.png

I ask because I never had this log in before when all I used my QNAP for was Plex but I started playing with QuMagie, PhotoStation and myQnapcloud Link and the log in from [appuser] 127.0.0.1 started the same time I installed QuMagie, PhotoStation and myQnapcloud. I know 127.0.0.1 is the QNAP local host and there are no other IPs attached indicating anyone is logging in from outside my network.

My QNAP is off the net ALL upnp is off and no ports are forwarded, passes the security checks at the intermediate level on security adviser.

I could not find a definitive answer to this but seems like this is the case.

UPDATE 4/11/21: I isolated where the [appuser] log in from 127.0.0.1 was coming from. Turns out Security Advisor for QNAP logs in as [appuser]. I isolated this happening when Security Advisor performed its weekly scan and when I stopped Security Advisor I no longer saw [appuser] log in 10 seconds after I logged in to my NAS, When I started Security Advisor back up it started again. I will be leaving it off now and only turn it on to scan manually.

[Skwor]

Interesting, no one knows the answer to this?

[dolbyman]

google search comes up with several hits

viewtopic.php?f=50&t=155426
viewtopic.php?f=50&t=131193&start=15#p615382
https://www.reddit.com/r/qnap/comments/ ... om_127001/

[Skwor]

google search comes up with several hits

viewtopic.php?f=50&t=155426
viewtopic.php?f=50&t=131193&start=15#p615382
https://www.reddit.com/r/qnap/comments/ ... om_127001/

Yes I found those earlier, as I alluded to in my top post the information I found is a bit inconclusive. Those hits also describe failed log ins from different IPs as well. I have no such issue with other IPs.

In my case it is only generated from the local host and appears to correspond with the QNAP apps I recently installed. I was looking to get some conformation from users who may have asked this question before. It is interesting this subject seems to be void of details.

My best understanding is that [appuser] from 127.0.0.1 can be and is expected as a normal log in for the QNAP apps in question.

[dolbyman]

so do you have surveillance station running?

that seems to be a common culprit

[Skwor]

No, I removed PhotoStation and only have Qumagie, QuCore and myCloudlink running now (also Plex but that was always running). I am thinking myCloudlink is the guilty party, I think that is how Qnap accesses the device to allow other apps to work through myCloudlink. I can see NO reason at all why QuCore would need access given it is the AI engine.

One thing I noticed is anytime I log into my Qnap I will see [appuser] log in from the local host 8 to 12 seconds later if I go check my access logs.

[Skwor]

UPDATE 4/11/21: I isolated where the [appuser] log in from 127.0.0.1 was coming from. Turns out Security Advisor for QNAP logs in as [appuser]. I isolated this happening when Security Advisor performed its weekly scan and when I stopped Security Advisor I no longer saw [appuser] log in 10 seconds after I logged in to my NAS, When I started Security Advisor back up it started again. I will be leaving it off now and only turn it on to scan manually.

[aesculus]

Plex can also create an appuser logon too.