strange uer in my ls -l

ekdya · 10-06-2003, 02:26 PM

$ls -l
-rw------- 1 man users 7434 Oct 5 14:27 zmanBOYRtR
I don't remeber making an account for this user or even having a group named uses.

how do I go about this?

thanks

Blinker_Fluid · 10-06-2003, 02:59 PM

users is a default group. I have never heard of a default man user though...
Some things to check:
last <-- does this show any users that you don't know or are unfamiliar with?
/etc/passwd <-- There are system users that you probably won't want to get rid of most will have /sbin/nologin for the shell. What shell does the man user have?
/etc/shadow <-- does the man user have a password set? (second field) I believe !! indicates nologin

Other than that maybe check /var/log/messages or /var/log/secure...
There is a start anyway...

ekdya · 10-07-2003, 02:02 AM

Quote:

Originally posted by Blinker_Fluid
users is a default group. I have never heard of a default man user though...
Some things to check:
last <-- does this show any users that you don't know or are unfamiliar with?

no mention of man here

/etc/passwd <-- There are system users that you probably won't want to get rid of most will have /sbin/nologin for the shell. What shell does the man user have?

~# grep "man" /etc/passwd
man:x:6:100:man:/var/cache/man:/bin/sh

/etc/shadow <-- does the man user have a password set? (second field) I believe !! indicates nologin

# grep "man" /etc/shadow
man:*:12285:0:99999:7:::

Other than that maybe check /var/log/messages or /var/log/secure...
There is a start anyway...

chort · 10-07-2003, 03:09 AM

Perhaps you should start by saying where you found the file and what the contents are (or what the file type is)?

Is it in /tmp? If not, where?

What file type is it?
file zmanBOYRtR

What are the contents?
less zmanBOYRtR

Do you have chkrootkit or tripwire installed (apparently not)? When you do get it figured out, it would be a good idea to install some file system monitoring tools.

ekdya · 10-07-2003, 04:49 AM

/tmp# file zmanBOYRtR
zmanBOYRtR: troff or preprocessor input text
/tmp# less zmanBOYRtR

.\" $OpenBSD: lpr.1,v 1.3 2000/03/19 17:57:06 aaron Exp $
.\"
.\" Copyright (c) 1980, 1990, 1993
.\" The Regents of the University of California. All rights reserved.
.\"