This is my first question on here and I hope it doesn't sound too ridiculous and I am posting it in the right place.

I have a Magento store running on Linux server. I am running two stores (Magento 1 and Magento 2) on the same server.

I checked my access logs and found SSH account that I would like to remove but not sure if it is safe to do so.

There is a user called aheadworks, this is the name of a company that supplies Magento extensions and modules and I believe it was created when installing some of their modules. I have removed all "Aheadworks" modules from my Magento 2 store but still use Aheadworks on my Magento 1 store.

Now, if I remove this user, is there a chance of something "breaking" or not working as it should?


From logs I can see that this user is being logged in on regular basis. There is definitely no one using those credentials. Could it be that some components are using this user?

aheadworks       pts/0      Thu Feb 22 09:56:18 +0000 2018


Result from executing ps -fu aheadworks:

[http]$ ps -fu aheadworks
www-data  2911  2329  0 10:39 ?        00:00:01 sshd: www-data@pts/0
www-data  2912  2911  0 10:39 pts/0    00:00:00 -bash
www-data  3080  3074  0 14:16 ?        00:00:00 /bin/sh -c /usr/bin/timeout 6h /bin/bash /microcloud/domains/vendor/domains/mydomain.co.uk/http/cron.sh > /dev/null 2>&1
www-data  3083  3080  0 14:16 ?        00:00:00 /usr/bin/timeout 6h /bin/bash /microcloud/domains/vendor/domains/mydomain.co.uk/http/cron.sh
www-data  3084  3083  0 14:16 ?        00:00:00 /bin/bash /microcloud/domains/vendor/domains/mydomain.co.uk/http/cron.sh
www-data  3133  3084  0 14:16 ?        00:00:00 timeout 43200 fakechroot /usr/sbin/chroot /microcloud/domains/vendor /bin/bash
www-data  3135  3133  0 14:16 ?        00:00:00 /bin/bash
www-data  3146  3135 23 14:16 ?        00:00:00 /usr/bin/php /domains/mydomain.co.uk/http/cron.php -mdefault 1
www-data  3606  2912  0 14:16 pts/0    00:00:00 ps -fu aheadworks
  • I would track down the source IP address as a first port of call. Commented Feb 23, 2018 at 11:29
  • The IP there is IP/netmask after connecting to the VPN.... You can't connect to SSH without first connecting to the VPN.
    – Greg
    Commented Feb 23, 2018 at 11:38
  • And do you believe a "component" would connect over a VPN? Commented Feb 23, 2018 at 11:49
  • This is why I am worried, however, I monitor all the VPN bundles sent and they all seems legit. There are only internal VPN bundles active. No one has credentials to this account but still, it's showing last SSH login date...
    – Greg
    Commented Feb 23, 2018 at 11:55
  • You cannot track the internal IP to an external VPN account, possible off some VPN log files? Commented Feb 23, 2018 at 12:00

1 Answer 1


Linux system user can’t be created at the level of php, i.e. Magento. More to that, Aheadworks extensions have no code which can work at the level of Linux system. The exception is the Advanced Search extension for Magento 1 thanks to it uses system search engine – sphix for search requests processing. In other words, this account can’t be connected with Aheadworks in any way, unless Aheadworks would carry out some activities on the support server following to the customer request with submitting created accesses to the server

  • I only took over from someone not that long ago and seen this account. I found that they will show as logged in as they share the same user ID as www-data when they might actually not be in use. If I ran an install script as root that was configured or backdoored to create SSH users then the account could possibly be created automatically but as I ran the install scripts via web or as www-data then there is no chance for it to be automatically created so I can assume it was manually created before for some support reasons and then left. I will mark your answer as accepted. Thanks for interest.
    – Greg
    Commented Mar 13, 2018 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .