local user get created magically ! system hacked ?

Mateusz Marzantowicz mmarzantowicz at osdf.com.pl
Tue Dec 3 22:25:54 UTC 2013


On 03.12.2013 23:08, Jehan Procaccia wrote:
> hello
> I use about a hundred fedora19 stations in computer labs at our school
> users accounts comes from an ldap directory and the homedir is
> automounted via NFS.
> However, recently I noticed that on some stations, local user account
> had been created !
> looking at the log file, I discovered in /var/log/secure  something like
> this:
> 
> /accounts-daemon: request by system-bus-name ::1.733
> [/usr/libexec/gnome-initial-setup pid:15259 uid:991]: create user 'foobar'//
> //useradd[29724]: new group: name=foobar, GID=1001//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: new user:
> name=susana, UID=1001, GID=1001, home=/home/susana, shell=/bin/bash//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: add 'susana' to
> group 'wheel'//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: add 'susana' to
> shadow group 'wheel'/
> 
> Scary ! how comes gnome-initial-setup could create users, and morever
> add them to the wheel group !
> could it be a bug in /gnome-initial-setup , /a feature side effect ? or
> our students found a "back door" ?
> any suggestion greatly appreciated .
> 

Maybe there was no connection to LDAP server and gnome-initial-setup was
presented to your pupils in order to make system usable. What happened
next - you already know.

Remove gnome-initial setup package from your system to disable this
back-door.

BTW. g-i-s lets you create user with admin privileges (wheel group).
It's nothing unusual in "local" setups.



Mateusz Marzantowicz



More information about the users mailing list