How can I check to see if any users have been added or removed recently on my Linode?
Linode
Linode Staff
I'm cleaning my system from a compromise, and want to check to see if any users were added or removed on my Linode. How do I do that?
1 Reply
tommydavidson
Linode Staff
You can check to see if any users were created or deleted recently by checking the file /var/log/auth.log
. When I deploy a new server and create a user with a StackScript I use, this is what I find in auth.log
:
Mar 6 17:29:24 localhost groupadd[1182]: group added to /etc/group: name=testaccount, GID=1000
Mar 6 17:29:24 localhost groupadd[1182]: group added to /etc/gshadow: name=testaccount
Mar 6 17:29:24 localhost groupadd[1182]: new group: name=testaccount, GID=1000
Mar 6 17:29:24 localhost useradd[1186]: new user: name=testaccount, UID=1000, GID=1000, home=/home/testaccount, shell=/bin/bash
Mar 6 17:29:24 localhost usermod[1194]: change user 'testaccount' password
Mar 6 17:29:24 localhost chfn[1199]: changed user 'testaccount' information
Mar 6 17:29:24 localhost chpasswd[1204]: pam_unix(chpasswd:chauthtok): password changed for testaccount
Mar 6 17:29:24 localhost gpasswd[1207]: user testaccount added by root to group sudo
Deleted users will show similar, but opposite entries.
If your Linode has been compromised, you should also check out this post as well for instructions on how to investigate the compromise and recover your Linode.