2

from /etc/passwd:

backup:x:34:34:backup:/var/backups:/bin/sh

The home directory listed is /var/backups which is owned by root:root. Here are the contents of the home directory:

total 4.1M
drwxr-xr-x  2 root root   4.0K May 29 11:17 ./
drwxr-xr-x 13 root root   4.0K May 28 00:32 ../
-rw-r--r--  1 root root    11K May 28 20:16 apt.extended_states.0
-rw-r--r--  1 root root   1.4K Apr 28 16:50 apt.extended_states.1.gz
-rw-r--r--  1 root root   1.2K Apr 14 21:06 apt.extended_states.2.gz
-rw-r--r--  1 root root   1.1K Apr  7 13:45 apt.extended_states.3.gz
-rw-r--r--  1 root root   1.1K Mar 28 22:00 apt.extended_states.4.gz
-rw-r--r--  1 root root   1.1K Mar 18 22:26 apt.extended_states.5.gz
-rw-r--r--  1 root root    970 Mar 14 23:52 apt.extended_states.6.gz
-rw-r--r--  1 root root   1.6M May 28 20:16 dpkg.status.0
-rw-r--r--  1 root root   432K May 27 23:04 dpkg.status.1.gz
-rw-r--r--  1 root root   431K Apr 28 16:50 dpkg.status.2.gz
-rw-r--r--  1 root root   426K Apr 14 21:06 dpkg.status.3.gz
-rw-r--r--  1 root root   420K Apr  7 13:45 dpkg.status.4.gz
-rw-r--r--  1 root root   418K Mar 28 22:00 dpkg.status.5.gz
-rw-r--r--  1 root root   416K Mar 20 21:08 dpkg.status.6.gz
-rw-------  1 root root    918 May 28 20:12 group.bak
-rw-------  1 root shadow  758 May 28 20:12 gshadow.bak
-rw-------  1 root root   1.8K May 28 20:12 passwd.bak
-rw-------  1 root shadow 1.2K May 28 20:12 shadow.bak

Obviously, these are backup files of some sort but which process is creating them? I did a quick find to see if this user owned anything but it didn't turn up much:

$ sudo find / -user backup
/var/mail/backup
0

1 Answer 1

0

That's pretty consistent with what I see in the same directory. I don't know what process(es) are creating them per se, but most of them are related to apt and dpkg lists of installed files and apps. I'd leave it alone and not worry - just the system doing its' thing.

1
  • 1
    Created by cron scripts, see grep -R backups /etc/cron.daily
    – Larsen
    Oct 14, 2020 at 9:11

Not the answer you're looking for? Browse other questions tagged .