Very nice box @jkr .
Root is tricky to find if others are not on the box IMO. Use the tool already mentioned to monitor processes, but generate traffic to the box while this is running using the VERY last step needed to get user. Observe the process, and consider how to leverage.