There is no "actual user", as far as I know. "asterisk" exists, but does not accept logins. However, I have tried installing ucpnode from module admin in the GUI as well as with fwconsole as root; same difference. I checked the audit.log in case it was an SELinux problem, but there's no issue there.
In fact I get 4 events to the audit.log when trying to start with fwconsole which indicate it's trying to sucessfully to run as asterisk
type=USER_START msg=audit(1448845085.743:7170): user pid=11845 uid=0 auid=0 ses=1057 msg='op=PAM:session_open acct="asterisk" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_ACQ msg=audit(1448845085.743:7171): user pid=11845 uid=0 auid=0 ses=1057 msg='op=PAM:setcred acct="asterisk" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_DISP msg=audit(1448845085.745:7172): user pid=11845 uid=0 auid=0 ses=1057 msg='op=PAM:setcred acct="asterisk" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=USER_END msg=audit(1448845085.746:7173): user pid=11845 uid=0 auid=0 ses=1057 msg='op=PAM:session_close acct="asterisk" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'A quick scan of /var/www/html shows nothing not owned by asterisk.
I get a successful fail2ban entry:
[2015-11-29 20:17:19] SECURITY[2325] res_security_log.c: SecurityEvent="SuccessfulAuth",EventTV="2015-11-29T20:17:19.412-0500",Severity="Informational",Service="AMI",EventVersion="1",AccountID="admin",SessionID="0xb6d00524",LocalAddress="IPV4/TCP/0.0.0.0/5038",RemoteAddress="IPV4/TCP/127.0.0.1/50286",UsingPassword="0",SessionTV="2015-11-29T20:17:19.412-0500"