3

Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...
2

Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).

In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.

Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.


See the man page:

/etc/passwd contains one line for each user account, 
with seven fields delimited by colons (“:”). These fields are:

   ·   login name
   ·   optional encrypted password
   ·   numerical user ID
   ·   numerical group ID
   ·   user name or comment field
   ·   user home directory
   ·   optional user command interpreter

The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.

0

In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:

...
uml-net:x:114:118::/nonexistent:/bin/false

The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1

It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.

Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.