I’m facing an issue with my forum: a bot with administrator privileges cannot be deleted, which makes me worry that a hacker might one day take over my forum and exploit this ghost bot user.
If your server system has been compromised, what difference does it make whether the attacker uses the bot or directly modifies the database?
It is sufficient to ensure that your SSH account credentials remain secure and are not leaked.
When did you first notice the bot being there?
What ‘bot’ is this? Created by the ai plugin? Discobot?
It was the previous Discourse bot, but it stopped working after the name change.
Perhaps your discourse_narrative_bot_enabled setting was disabled? IIRC there was a change to new sites where Discobot will be turned off by default.
This feature is currently enabled. I also asked AI, and to revoke admin privileges, the command line must be used.
“How to force remove a user with…” Click here to view Yuanbao’s answer
The user in question is not discobot, discobot is this instead
Beware that using the Rails console is an extraordinary action, and if you remove the wrong AI bot, you can break some functionality. Check this:
I think you can also remove admin privileges before deleting users from the GUI.
- Entering into the Rails console (you want to backup just in case):
cd /var/discourse/
./launcher enter app
rails c
- Removing the privileges:
u = User.find_by(username: "BOT_USERNAME")
u.revoke_admin!
You can’t delete admin users until you have demoted them. If you remove the bot’s admin rights you should be able to delete it.
I think this isn’t possible for (AI)-bot users. There is no “Revoke admin” button.
It might be a little difficult to notice that in a screenshot taken on a Chinese interface, so I am adding an English one:
The buttons between “manage keys” and the trust level dropdown, which are shown for normal admins, are missing on bot users.
It’s interesting, because OP’s bot is called ‘discourse-bot’, which doesn’t bring to mind any AI bot, or I’m mistaken.
I assumed it was a bot, because that’s the only explanation I know where those buttons you’d need to revoke admin to be able to delete the user are missing.
Hmm… likely a bot, but could it be from a plugin? I couldn’t find anything in core.
The AI agent bots can be renamed, I assume it was the case for the OP.
It’s an admin-level account which isn’t listed in the about.json, so my guess would be that makes it a bot.