LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-05-2004, 08:43 PM   #1
000000
LQ Newbie
 
Registered: Sep 2004
Location: German
Distribution: SUSE 9.1
Posts: 6

Rep: Reputation: 0
A hacked account or normal


Hi all
I am using suse 9.1 and I sometimes turn off the firewall and I have discovered many accounts that dont show in kdm even if I make them unhidden the accounts are:
@audio
@dialout
@users
@uccp
@video

I have searched for the meaning for uucp = unix-to-unix Copy system
I use so many p2p progs to download linux iso

are they normal accounts?

and thanks
 
Old 11-05-2004, 09:06 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
With the exception of uucp, those aren't normal users. However they are normal group IDs. Are you sure you're looking at the proper table? Take a look at /etc/passwd just to be sure (those group names will be in /etc/group).
 
Old 11-06-2004, 06:41 PM   #3
000000
LQ Newbie
 
Registered: Sep 2004
Location: German
Distribution: SUSE 9.1
Posts: 6

Original Poster
Rep: Reputation: 0
hi and thanks for your respond
this my /etc/group

root:x:0:
bin:x:1:daemon
daemon:x:2:
sys:x:3:
tty:x:5:
disk:x:6:
lp:x:7:
www:x:8:
kmem:x:9:
wheel:x:10:
mail:x:12:
news:x:13:
uucp:x:14:eminaga,light,clamav
shadow:x:15:
dialout:x:16:eminaga,light,clamav
audio:x:17:eminaga,light,clamav
floppy:x:19:
cdrom:x:20:
console:x:21:
utmp:x:22:
at:x:25:
public:x:32:
video:x:33:eminaga,light,clamav
games:x:40:
xok:x:41:
trusted:x:42:
modem:x:43:
ftp:x:49:
postfix:x:51:
localham:x:56:
maildrop:x:59:
man:x:62:
sshd:x:65:
ntadmin:x:71:
distcc:x:101:
nobody:x:65533:nobody
nogroup:x:65534:nobody
users:x:100:light
zope:!:102:
clamav:!:52:

IS IT ALL NORMAL?
 
Old 11-06-2004, 10:34 PM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
In SuSE, it is normal to have users belong to the video, audio, dialout, and uucp groups. Are eminaga & light users on the system? The user and group clamav are added by the clamav antivirus software, so I'm assuming that you have it installed? The user eminaga looks a little odd (doesn't appear as a member of "users" and I can't think of any software that installs a system user with that name).

Also take a look at /etc/passwd and make sure that you don't have any users other than root (particularly eminaga) with a UID or GID of 0 or any other abnormal users.
 
Old 11-07-2004, 11:32 AM   #5
000000
LQ Newbie
 
Registered: Sep 2004
Location: German
Distribution: SUSE 9.1
Posts: 6

Original Poster
Rep: Reputation: 0
dont worry eminaga ist a normal account - it is even my last name - and also light and yes i have installed clamav 2 days ago - who asked-
I didnt find any user with 0 id gid
and this my passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash
daemon:x:2:2aemon:/sbin:/bin/bash
lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
news:x:9:13:News system:/etc/news:/bin/bash
uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
games:x:12:100:Games account:/var/games:/bin/bash
man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
wwwrun:x:30:8:WWW daemon apache:/var/lib/wwwrun:/bin/false
ftp:x:40:49:FTP account:/srv/ftp:/bin/bash
postfix:x:51:51:Postfix Daemon:/var/spool/postfix:/bin/false
mysql:x:60:2:MySQL database admin:/var/lib/mysql:/bin/false
zope:x:64:102:Zope:/opt/zope:/bin/false
sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false
ntp:x:74:65534:NTP daemon:/var/lib/ntp:/bin/false
vdr:x:100:33:Video Disk Recorder:/var/spool/video:/bin/false
distcc:x:101:101istcc Daemon:/etc/distcc:/bin/false
nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
light:x:1000:100:Light:/home/light:/bin/bash
eminaga:x:1001:100:eminaga:/home/eminaga:/bin/bash
clamav:x:52:52:ClamAV Daemon:/:/bin/false

ganz normal
 
Old 11-07-2004, 02:19 PM   #6
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Looks like you're in good shape then.
 
Old 11-07-2004, 06:09 PM   #7
000000
LQ Newbie
 
Registered: Sep 2004
Location: German
Distribution: SUSE 9.1
Posts: 6

Original Poster
Rep: Reputation: 0
veilen dank
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
cyrus email account linux account nobu Linux - Enterprise 0 10-31-2005 03:16 AM
xawtv doesn't work from normal user account adityavpratap Slackware 2 10-18-2005 09:01 AM
FC4 xorg issue - 1280x1024 works for root, but not normal user account peitz11 Linux - Software 2 09-29-2005 08:40 AM
Logging in as root after ¨normal" account created Xalies Linux - Newbie 2 08-02-2004 01:36 AM
Normal user account cannot start KDE tagit Linux - Newbie 2 12-22-2003 04:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:21 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration