0

I've been playing around with Splunk and got some questions:

  1. I have installed it using

    rpm -iv splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm

  2. I removed it next using

rpm -e splunk-7.2.3-06d57c595b80.x86_64

My question is, why didn't rpm remove the Splunk user from /etc/passwd ? Also I'm a bit puzzled why removing via splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm did not work (but the installation did) and I had to get the actual package name with rpm -qa | grep splunk first?

Is this related to the Splunk rpm package or rather standard?

|improve this question
  • 1
    It's a general policy issue (and likely a duplicate). Removing a user requires one to ensure that there are no leftover files belonging to the deleted user. – Thomas Dickey Dec 27 '18 at 18:52
  • @ThomasDickey Thank you. What do you mean "general policy issue"? – blablatrace Dec 27 '18 at 18:54
  • 1
    Leaving files owned by an unspecified user (only a number) is considered by some a security problem. Reducing problems like that is a policy. See this – Thomas Dickey Dec 27 '18 at 19:02
  • To add to the second part of your question, you don't include the .rpm part of the package when removing it via rpm -e. – Nasir Riley Dec 27 '18 at 20:07
0

rpm packages consist of a bunch of files and optionally a group of scripts (pre/postinstall pre/postremove pre/postupgrade verify)

You can use the --list option to show what files are part of the package. These will be removed when you --erase the package.

rpm -qipl package.rpm

You can also include --scripts to dump the contents of the scripts. There isn't a whole lot of standardized templates or enforcement on how install / remove scripts work, so it's really up to the package maintainer. But you can certainly dump the --scripts of a package to discover exactly what an RPM is doing to your system so you can better write your own cleanup scripts.

rpm -qi --scripts package.rpm

You might even consider installing with --noscripts if you just need some files from an rpm and don't want or don't trust the maintainer to dink with the configuration of your system.

|improve this answer
0

Not removing a user together with a package is a standard.

Thomas already provided nice explanation in comments and linked this nice document https://ma.ttias.be/on-removing-users-with-postun-in-rpm-spec-files/

However, there is another reason. Many admins rely on LDAP or NIS to provide users to the system. And even before installing package which creates new user, they will first add that user to their LDAP. This is the reason why new users are created using:

getent passwd USERNAME >/dev/null || \
    useradd -r -g GROUPNAME -d HOMEDIR -s /sbin/nologin ...

i.e. before the user is created, the package should always check if the user already has been created.

And of course, you simply cannot remove LDAP user from a client system. So simple userdel may likely fail. So it is up to the admin to remove the user - using the tools he uses for user management.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.