2

I was following the guide here and listed all users in passwd. There I found the following problems:

/bin/false aparently allows channels and some form of forwarding

nm-openconnect:x:122:130:NetworkManager OpenConnect plugin,,,:/var/lib/NetworkManager:/bin/false

is this forwarding still possible with /bin/false nowadays (16.02)?

guest-2lq2jn:x:998:997:Guest:/tmp/guest-2lq2jn:/bin/bash

I don't know who this is or why this account exists. Its history is empty but it does seem to have root access. What should I do?

postgres:x:123:132:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

Why does postgreSQL have /bin/bash access? Is this normal?

I am sorry for asking three questions in one, but it can be hard to get one answered and it seems like they are sub-questions.

3
  • I guess the psql issue is known. The guest should be removed, but any way to check it didn't backdoor my computer? The forwarding, is it unsafe?
    – imonaboat
    Commented Jun 5, 2017 at 10:11
  • What makes you say that guest-2lq2jn has root access?
    – terdon
    Commented Jun 5, 2017 at 11:07
  • It seems to have a chroot or jail. These accounts came with KVM I think, my login screen has a QEMU login name, I'm not 100% sure when it appeared because my computer is always on.
    – imonaboat
    Commented Jul 10, 2017 at 6:57

1 Answer 1

0

/bin/false is a simple program which does nothing, and returns a status code indicating failure. you can still use it. It's a part of coreutils package so it's available by default.

"guest" line is related to Ubuntu guest user and does not have any harm or any spacial permissions to do anything to your system, it's a normal user which has access to bash however it can do nothing and all it's data are temporary.

about "postgres", it might need a bash to do a specific task.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .