FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu User

 
 
LinkBack Thread Tools
 
Old 07-01-2012, 09:04 PM
Adnane
 
Default Strange guest users!!

hello,



I recently found this on my /etc/passwd, and I don't know where they
come from, malicius users ?









guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash

guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash

guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash

guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash

guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash

whoopsie:x:119:131::/nonexistent:/bin/false

guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash

guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash





is there a way to prevent it if its bad ?








--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-01-2012, 10:54 PM
Roger
 
Default Strange guest users!!

On 02/07/12 07:04, Adnane wrote:




hello,



I recently found this on my /etc/passwd, and I don't know where
they come from, malicius users ?









guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash

guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash

guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash

guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash

guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash

whoopsie:x:119:131::/nonexistent:/bin/false

guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash

guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash





is there a way to prevent it if its bad ?












Yep I've got at lease one of those also.

roger





--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-01-2012, 11:20 PM
Rashkae
 
Default Strange guest users!!

On 07/01/2012 05:04 PM, Adnane wrote:

hello,

I recently found this on my /etc/passwd, and I don't know where they
come from, malicius users ?

**

*

guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash
guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash
guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash
guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash
guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash
whoopsie:x:119:131::/nonexistent:/bin/false
guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash
guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash

is there a way to prevent it if its bad ?





I'm only guessing here, but I think these are being left behind by
someone logging in as "Guest User" from the login screen. As to why
they arent' being cleaned up, that must be because the computer is not
being shut down properly while guest user is logged in.. (power failure,
computer is locking up, etc.)


If you don't want someone to be able to use the computer without logging
in properly, you'll have to disable the guest user login. (instructions
will depend on which version of Ubuntu you are using. LightDM or GDM.)




--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-02-2012, 02:32 AM
Florian Diesch
 
Default Strange guest users!!

Adnane <rabihadnane@gmail.com> writes:

> I recently found this on my /etc/passwd, and I don't know where they
> come from, malicius users ?
>
> **
>
> *
>
> guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash
> guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash
> guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash
> guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash
> guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash
> whoopsie:x:119:131::/nonexistent:/bin/false
> guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash
> guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash
>
> is there a way to prevent it if its bad ?


Those "guest-*" users are created when you open a guest session. They
are delete when log off from the guest session.

So either you have that many guest sessions open at the moment or
someone didn't properly log off from his/her guest sessions in the past.

Check which /tmp/guest-* folders do exist, only those guest sessions are
still active.


The user "whoopsie" is used by the Ubuntu crash database submission
daemon "whoopsie"




Florian
--
Plugin for Nautilus to create and modify application starters:
Arronax <http://www.florian-diesch.de/software/arronax/>

--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-02-2012, 08:34 PM
Robert Holtzm
 
Default Strange guest users!!

On Sun, Jul 01, 2012 at 09:04:26PM +0000, Adnane wrote:
> hello,
>
> I recently found this on my /etc/passwd, and I don't know where they
> come from, malicius users ?
>
> **
>
> *
>
> guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash
> guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash
> guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash
> guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash
> guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash
> whoopsie:x:119:131::/nonexistent:/bin/false
> guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash
> guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash
>
> is there a way to prevent it if its bad ?

My /etc/passwd file shows
"nobody:x:65534:65534:nobody:/nonexistent:/bin/sh" which puzzels me. Any
explanation?

--
Bob Holtzman
If you think you're getting free lunch,
check the price of the.
Key ID: 8D549279
--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-02-2012, 08:58 PM
Paul Smith
 
Default Strange guest users!!

On Mon, 2012-07-02 at 13:34 -0700, Robert Holtzm wrote:
> My /etc/passwd file shows
> "nobody:x:65534:65534:nobody:/nonexistent:/bin/sh" which puzzels me. Any
> explanation?

Various parts of a UNIX system use UID 65534 to represent an "anonymous"
user. For example, if your system is exporting filesystems via NFS
(Network File System), then when a root user on an NFS client that is
mounting your filesystem tries to access or create files on your
exported filesystem, their UID will be mapped to 65534 (by default).
This is just handy line in your /etc/passwd file so that if you run "ls"
you'll see that username as "nobody" instead of the numeric "65534".

It's harmless, please ignore. Although why it has a shell of /bin/sh
instead of /bin/false or something similar, I'm not sure. Most
certainly the account is locked (no valid password) anyway so it doesn't
really matter I guess.



--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-04-2012, 06:46 AM
Robert Holtzm
 
Default Strange guest users!!

On Mon, Jul 02, 2012 at 04:58:32PM -0400, Paul Smith wrote:
> On Mon, 2012-07-02 at 13:34 -0700, Robert Holtzm wrote:
> > My /etc/passwd file shows
> > "nobody:x:65534:65534:nobody:/nonexistent:/bin/sh" which puzzels me. Any
> > explanation?
>
> Various parts of a UNIX system use UID 65534 to represent an "anonymous"
> user. For example, if your system is exporting filesystems via NFS
> (Network File System), then when a root user on an NFS client that is
> mounting your filesystem tries to access or create files on your
> exported filesystem, their UID will be mapped to 65534 (by default).
> This is just handy line in your /etc/passwd file so that if you run "ls"
> you'll see that username as "nobody" instead of the numeric "65534".
>
> It's harmless, please ignore. Although why it has a shell of /bin/sh
> instead of /bin/false or something similar, I'm not sure. Most
> certainly the account is locked (no valid password) anyway so it doesn't
> really matter I guess.

Thanks for clearing that up.

--
Bob Holtzman
If you think you're getting free lunch,
check the price of the beer.
Key ID: 8D549279
--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 07-04-2012, 07:29 AM
Nolan
 
Default Strange guest users!!

On 07/01/2012 03:54 PM, Roger wrote:
> On 02/07/12 07:04, Adnane wrote:
>> hello,
>>
>> I recently found this on my /etc/passwd, and I don't know where they come from, malicius
>> users ?
>>
>> **
>>
>> *
>>
>> guest-ju5MVt:x:114:126:Guest,,,:/tmp/guest-ju5MVt:/bin/bash
>> guest-wG6ljf:x:115:127:Guest,,,:/tmp/guest-wG6ljf:/bin/bash
>> guest-pnnpDM:x:116:128:Guest,,,:/tmp/guest-pnnpDM:/bin/bash
>> guest-vDcp9d:x:117:129:Guest,,,:/tmp/guest-vDcp9d:/bin/bash
>> guest-VBqZ2D:x:118:130:Guest,,,:/tmp/guest-VBqZ2D:/bin/bash
>> whoopsie:x:119:131::/nonexistent:/bin/false
>> guest-57TzoY:x:120:132:Guest,,,:/tmp/guest-57TzoY:/bin/bash
>> guest-5Wr1lz:x:121:134:Guest,,,:/tmp/guest-5Wr1lz:/bin/bash
>>
>> is there a way to prevent it if its bad ?
>>
>>
>>
>>
> Yep I've got at lease one of those also.
> roger
>
>
>
And how long did you "lease" it for ?
At "least" 3 times?
Nolan

--
Nolan Cooper
Linux User: 190812
Debian/Ubuntu-12.04==<b>Precise Pangolin</b>

--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 

Thread Tools




All times are GMT. The time now is 11:32 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org