Why do syslog and uml-net have /home in /etc/passwd?Steps for restoring the home directory? (User IDs etc.)I deleted the “/etc/passwd” file and cannot log inWhy is there a man entry in /etc/passwdIs it safe to revoke group other access to every directory in a file system?Why is syslog a user?Usernames in /etc/passwdhow to use old /etc/passwd file and old home directories after system restore?
How can I use Charisma instead of Strength or Dexterity for weapon attacks without being a Hexblade warlock?
Can Shadow Pokémon be Shiny in Pokémon Go?
Which verb means "to pet <an animal>"?
The falling broom handle
Convert Unix timestamp to human-readable time
Multithreading program stuck in optimized mode but runs normally in -O0
Is there a way in which all the members can be seated?
What helped Einstein to provide a more accurate description of gravity than Newton?
18-month-old kicked out of church nursery
What Constitutes a Secondary Dominant?
Can I swap out this 20A breaker for a 15A breaker?
How can I manage my team to maintain a reasonable productivity when my employer doesn't treat employees well?
180W Laptop charged with 45W charger, is it dead?
Why can't my custom camera body focus to far distances?
Leaving car in Lubbock, Texas for 1 month
What are the applications of the Mean Value Theorem?
How can I tell if I have simplified my talk too much?
Why do some PCBs have the courtyard in the silkscreen layer?
Does no-one standing against the speaker of the house in UK lead to the local electorate being disenfranchised?
Is it okay to have an email address called "SS"?
Finding big cacti between Phoenix, Las Vegas, and Los Angeles
I can be found near gentle green hills and stony mountains
Where are the NPC mages' spellbooks in the Lost Mine of Phandelver adventure?
Are there any real life instances of aircraft aborting a landing to avoid a vehicle?
Why do syslog and uml-net have /home in /etc/passwd?
Steps for restoring the home directory? (User IDs etc.)I deleted the “/etc/passwd” file and cannot log inWhy is there a man entry in /etc/passwdIs it safe to revoke group other access to every directory in a file system?Why is syslog a user?Usernames in /etc/passwdhow to use old /etc/passwd file and old home directories after system restore?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...
users home-directory
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
add a comment
|
Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...
users home-directory
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
add a comment
|
Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...
users home-directory
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
Can someone explain why users syslog and uml-net have /home in /etc/passwd, even though these directories in /home don't actually exist?
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
syslog:x:101:104::/home/syslog:/bin/false
...
uml-net:x:107:111::/home/uml-net:/bin/false
...
users home-directory
users home-directory
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
edited Mar 23 '17 at 13:19
Zanna
53.6k15 gold badges150 silver badges252 bronze badges
53.6k15 gold badges150 silver badges252 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
asked Mar 23 '17 at 12:53
CppLearnerCppLearner
5422 gold badges8 silver badges18 bronze badges
5422 gold badges8 silver badges18 bronze badges
add a comment
|
add a comment
|
2 Answers
2
active
oldest
votes
Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).
In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.
Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.
See the man page:
/etc/passwd contains one line for each user account,
with seven fields delimited by colons (“:”). These fields are:
· login name
· optional encrypted password
· numerical user ID
· numerical group ID
· user name or comment field
· user home directory
· optional user command interpreter
The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
add a comment
|
In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:
...
uml-net:x:114:118::/nonexistent:/bin/false
The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1
It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.
Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f896040%2fwhy-do-syslog-and-uml-net-have-home-in-etc-passwd%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).
In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.
Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.
See the man page:
/etc/passwd contains one line for each user account,
with seven fields delimited by colons (“:”). These fields are:
· login name
· optional encrypted password
· numerical user ID
· numerical group ID
· user name or comment field
· user home directory
· optional user command interpreter
The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
add a comment
|
Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).
In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.
Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.
See the man page:
/etc/passwd contains one line for each user account,
with seven fields delimited by colons (“:”). These fields are:
· login name
· optional encrypted password
· numerical user ID
· numerical group ID
· user name or comment field
· user home directory
· optional user command interpreter
The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
add a comment
|
Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).
In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.
Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.
See the man page:
/etc/passwd contains one line for each user account,
with seven fields delimited by colons (“:”). These fields are:
· login name
· optional encrypted password
· numerical user ID
· numerical group ID
· user name or comment field
· user home directory
· optional user command interpreter
The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
Inherited from old times and to not break stuff. Every line in /etc/passwd needs a home (see the addition below). And /etc/passwd is something we take as is as part of the Linux system (and not a Debian/Ubuntu specific feature).
In the old days syslog-ng was pretty common and that used /home/syslog/ to create a directory in there for each data source type.
Before the switch to systemd using rsyslog, storing logs in /var/log/syslog was more common. And systemd uses /run/systemd/journal/syslog.
See the man page:
/etc/passwd contains one line for each user account,
with seven fields delimited by colons (“:”). These fields are:
· login name
· optional encrypted password
· numerical user ID
· numerical group ID
· user name or comment field
· user home directory
· optional user command interpreter
The encrypted password and user command interpreter explicitly are mentioned as "optional". So I would assume the others are mandatory.
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
edited Mar 23 '17 at 13:58
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
answered Mar 23 '17 at 13:52
RinzwindRinzwind
224k29 gold badges433 silver badges577 bronze badges
224k29 gold badges433 silver badges577 bronze badges
add a comment
|
add a comment
|
In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:
...
uml-net:x:114:118::/nonexistent:/bin/false
The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1
It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.
Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
add a comment
|
In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:
...
uml-net:x:114:118::/nonexistent:/bin/false
The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1
It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.
Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
add a comment
|
In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:
...
uml-net:x:114:118::/nonexistent:/bin/false
The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1
It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.
Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
In my case the user was possibly created by a malicious crypto mining script, the give away was it was the last user added:
...
uml-net:x:114:118::/nonexistent:/bin/false
The server was likely infected by this: https://security.stackexchange.com/questions/201263/a-process-called-watchbog-is-mining-crypto-currency-in-our-server-how-do-i-st?noredirect=1&lq=1
It also left a ssh publickey login backdoor and various modified cron hooks. Your best bet is to re-install server with latest updates, and revision track /etc/ to help you notice differences - the latter helped me.
Some files had user group Debian-exim so likely this server got compromised due to this https://www.linuxtechnews.com/cve-2019-10149-debian-has-released-critical-security-update-for-exim/
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
edited Jun 14 at 17:42
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
answered Jun 14 at 17:08
Daniel SokolowskiDaniel Sokolowski
11 bronze badge
11 bronze badge
add a comment
|
add a comment
|
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f896040%2fwhy-do-syslog-and-uml-net-have-home-in-etc-passwd%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
