4

Unsolved mystery - I was given a coworker's Ubuntu 12.04.1 LTS machine and set up my own (sudo/admin) user on there from the command line. I switched to my user (from his sudo/admin user) and confirmed everything was okay using the groups command and the /etc/passwd file looked great. After months of everything working perfectly, a power outage shut down the machine for the first time since I inherited it.

After booting, my new user disappeared. It's not in the /etc/passwd file and there is no entry in the /home directory. I created the user the same as I did before, and there were no errors to indicate that the user still existed.

What happened?

As requested, here is the output of

olduser@machine:~$ ls -lait /home 
total 16 
3408126 drwxr-xr-x 2 newuser newuser 4096 Nov 20 10:28 newuser 
3407873 drwxr-xr-x 4 root root 4096 Nov 20 10:28 . 
3407874 drwxr-xr-x 36 coworker coworker 4096 Nov 20 10:00 bvillupu 
2 drwxr-xr-x 26 root root 4096 Oct 3 2012 .. 
3408259 lrwxrwxrwx 1 root root 44 Aug 9 2012 .directory -> /etc/kubuntu-default-settings/directory-home
  • What does the command line give back? ls -lait /home/ – aurelien Nov 20 '14 at 17:45
  • Welcome to Unix & Linux @k0d3x! This is really a comment, not an answer. Answers should only be used to provide actual answers not to ask for clarification. If you spend some more time on the site, you will gain sufficient privileges to leave comments on posts. In the meantime, I have converted your answer to a comment. – terdon Nov 20 '14 at 18:11
  • @sg Please edit your question to add extra information, it is hard to read and easy to miss in the comments. – terdon Nov 20 '14 at 18:11
1

I know this doesn't answer your question but if the user was missing from /etc/passwd then someone with sudo/root access at some time deleted the user. Being that the user's home directory was also missing gives me the impression that someone ran a not only did a userdel they did a rm -rf /home/user. That implies that there was intent to delete. You can check the secure file in /var/log to see if, in fact, someone deleted the user.

| improve this answer | |
  • There is no /var/log/secure file, but I did use grep on /var/log/* to look for 'myuser', 'delete', and 'deluser' and came up with nothing – s g Nov 20 '14 at 22:39
  • I thought the /var/log/secure was univeral but it may just be a RHEL based thing. – Jeight Nov 20 '14 at 22:46
  • Make sure to do a grep -r myuser /var/log/ to ensure grep goes recursively down the directories. If deluser wasn't used and the user was manually deleted from /etc/passwd then there won't be a log anyway. – Jeight Nov 20 '14 at 22:53
  • Right, used -r and got nothin', I also checked crontabs for anything weird but there weren't any scripts running there either. – s g Nov 20 '14 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.