Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite
1

A user has created a directory with files, but the user does not exist in /etc/passwd or /etc/group. The system is a Fedora server with an FTP server and proxy which redirects to a CentOS server with Apache where the directory was created. Where could the user have come from? Is this a security problem?

share|improve this question
Is it possible at all that the user has been removed? What happens to the files belonging to him in that case? – rahmu Oct 12 '11 at 13:17
With ls -l I can see his entries. I don't know if it has been removed. If then he has root access... But good question. Is the passwd the single place where such a user can be put in? Or can with a security hole user-rights written without ever an existing user? – testing Oct 12 '11 at 13:27

2 Answers

up vote 7 down vote accepted

Other possibilities which don't involve security breach:

  • If root extracts some files from a tar, tar will create that files with uid/gid of source system even if that user/group does not exist on destination host.
  • If root uses rsync -a to synchronize directory on two differents systems, rsync will create that files with uid/gid of source system even if that user/group does not exist on destination host.

A lot of file transfer activities, between hosts that have not the same user list, can create this kind of unknown owner files.

share|improve this answer
The directory has been created from a tar file. The owner of the tar file is root. So the question now is, how the tar file came on the server. The normal ftp log files doesn't mention something. Either its the apache or a CMS. – testing Oct 12 '11 at 14:25
1  
IMHO, this is another question. You can start reading these response on "server fault": How do I know if my Linux server has been hacked? and How can I detect unwanted intrusions on my servers?. – andcoz Oct 12 '11 at 14:44
1  
Another couple of reasons to never work as root. – dmckee Oct 12 '11 at 15:09
Or root simply downloaded the file, with wget or ftp (client) or similar, none of which makes logs. After all, root had to extract it, whether this was done with a shell or part of a CMS. Do you (or whoever else legitimately has root) not remember doing such a thing? – Random832 Oct 12 '11 at 17:13
up vote 2 down vote

Two obvious possibilities which don't involve security breach:

  • exported file system (NFS, samba, ...) to a computer which has such account
  • network wide identification (NIS, ldap, ...) which allows such account
share|improve this answer
I also thought that. But showmount tells me too much results. So I need another way to narrow the cause for the security breach. – testing Oct 12 '11 at 14:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.