Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I was checking my /etc/passwd, when I noticed a user called backup1. What attracted my attention is the number 1 at the end. Is it ok? how can I know if this user is compromised?

Im using ubuntu 12.04

thank you

EDIT:

This is the /etc/passwd line corresponding to backup1:

backup1:x:0:1006::/home/backup1:/bin/sh

And this is the one of /etc/shadow

backup1:$6$ETiP/5u7$p7t.GYWhI7ocUrfBxPmSrUW4YFuU.UC0jpBqgycAAf31j91m8FzurWX67dU3NuWhX4fv4sr6WnGJitMD9wgKb1:15761:0:99999:7:::

But the user backup (without the 1), also have apassword on /etc/shadow.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

I don't recognize that user name offhand, but that doesn't necessarily mean anything (since it is not my system).

What is the uid of the user? Normally, any uid between 100 and 999 are dynamically created by packages installed on the system. You can search through package postinst scripts to find packages which may have created it: $ fgrep backup1 /var/lib/dpkg/info/*.postinst. Does the user have a password in /etc/shadow? Is the account locked? What is the user's default shell?


Followup to additional information:

A uid of 1006 is a "normal" login account, not a system account. Additionally, since the user has a home directory in /home, has a login shell, and has a password this all indicates that the account was created by someone running adduser as root. The account is not locked. A locked account will have an '!' before the password hash. You can lock the account by running passwd -l backup1.

Potential sources for the creation of this account include:

  • other system administrators
  • third-party software installers or packages that are not from the official Ubuntu repositories

You can also use the lastlog command to see when that account last logged in.

share|improve this answer
    
The uid is 1006. The fgrep output is empty. Check the edit for the /etc/passwd and /etc/shadow lines for backup1. The default shell is /bin/sh. How do I know if an account is locked? –  Throoze Mar 20 '13 at 3:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.