local user get created magically ! system hacked ?

[Michael Schwendt]

On Tue, 03 Dec 2013 23:08:04 +0100, Jehan Procaccia wrote:

> hello
> I use about a hundred fedora19 stations in computer labs at our school
> users accounts comes from an ldap directory and the homedir is 
> automounted via NFS.
> However, recently I noticed that on some stations, local user account 
> had been created !
> looking at the log file, I discovered in /var/log/secure  something like 
> this:
> 
> /accounts-daemon: request by system-bus-name ::1.733 
> [/usr/libexec/gnome-initial-setup pid:15259 uid:991]: create user 'foobar'//
> //useradd[29724]: new group: name=foobar, GID=1001//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: new user: 
> name=susana, UID=1001, GID=1001, home=/home/susana, shell=/bin/bash//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: add 'susana' to 
> group 'wheel'//
> //secure-20131117:Nov 15 17:16:43 b3-4 useradd[29724]: add 'susana' to 
> shadow group 'wheel'/
> 
> Scary ! how comes gnome-initial-setup could create users, and morever 
> add them to the wheel group !
> could it be a bug in /gnome-initial-setup , /a feature side effect ? or 
> our students found a "back door" ?
> any suggestion greatly appreciated .

See what running

  /usr/libexec/gnome-initial-setup --force-new-user 

does on one of your installed machines, where 'susana' has not been active
before. Normally, it would prompt for the root password before creating a
new account, but perhaps something else happens with your setup.