Why do syslog and uml-net have /home in /etc/passwd?

Question

Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...

Answer 1

Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).

In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.

Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.

---

See the man page:

/etc/passwd contains one line for each user account, 
with seven fields delimited by colons (“:”). These fields are:

   ·   login name
   ·   optional encrypted password
   ·   numerical user ID
   ·   numerical group ID
   ·   user name or comment field
   ·   user home directory
   ·   optional user command interpreter

The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.

Answer 2

In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:

...
uml-net:x:114:118::/nonexistent:/bin/false

The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1

It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.

Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/