Monday, May 13, 2024
 Popular · Latest · Hot · Upcoming
27
rated 0 times [  27] [ 0]  / answers: 1 / hits: 3737  / 2 Years ago, tue, may 10, 2022, 9:43:58

Someone tried to hack my root user. It was interesting to me to find all users in my system. I don't remember I create any of them. Can hacker use any of other default users to enter the system (with default Linux system settings)? I can't login with any of them to check because I don't know their passwords.


I run command to get all users: cat /etc/passwd:


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
systemd-coredump:x:999:997:systemd Core Dumper:/:/sbin/nologin
systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
tss:x:59:59:Account used for TPM access:/dev/null:/sbin/nologin
polkitd:x:998:996:User for polkitd:/:/sbin/nologin
unbound:x:997:994:Unbound DNS resolver:/etc/unbound:/sbin/nologin
sssd:x:996:993:User for sssd:/:/sbin/nologin
chrony:x:995:992::/var/lib/chrony:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
nginx:x:994:991:Nginx web server:/var/lib/nginx:/sbin/nologin

More From » login

 Answers
3

Yes, very secure.


All of these users are created by the software you installed it for. Those users often come with a systemd service specifically for that software.


Mind the /sbin/nologin at the end of some of the lines. That means NOBODY can use that user to login into a terminal session.


halt and shutdown are there so users can stop a system.


root has lock on the password (there will be a ! in /etc/shadow) set during install. It can be removed if need be but we generally do not. It is connected to your admin user.


[#386] Wednesday, May 11, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
rialhirt

Total Points: 422
Total Questions: 113
Total Answers: 120

Location: France
Member since Sun, May 15, 2022
2 Years ago
rialhirt questions
Mon, May 24, 21, 18:24, 3 Years ago
Thu, Feb 16, 23, 16:32, 1 Year ago
Mon, Jun 13, 22, 03:02, 2 Years ago
Tue, Jun 15, 21, 12:40, 3 Years ago
;