Easy way to identify system created account or account for system services

Easy way to identify system created account or account for system services

Post by lonelyplanet9 » Thu, 18 Jul 2002 16:08:33



Hi,

I'm compiling unix & linux account list in my company under linux 6.2,
7.0 & digital unix 4 platforms (I'm not the original administrator of
these servers & no document left behind by previous adminstrator who
had left).

As I cat the /etc/passwd file, I found many accounts seem be used by
OS or system services only. Some of them are very obvious like adm,
bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
platform has some unique account names which seem not being used by
users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
etc.

I would like to ask is there any easy way to identify which account is
human  user account and which being OS / OS service accounts ? Any
document available on internet to list those common system services
accounts ?

Can I based on the initial program or shell that executes to help
judge this e.g. user accounts will initialize a shell like bash, csh,
etc while system own accounts will not.

Tks!

 
 
 

Easy way to identify system created account or account for system services

Post by Eric Worral » Thu, 18 Jul 2002 17:20:58


Yep. System accounts dont have a password. Most modern distros use
/etc/shadow to hold passwords (you need to be root to see it). The
format of /etc/shadow is:
username:password:otherstuff...

Accounts in /etc/shadow which look like:
accountname:*:otherstuff...
accountname:!!:otherstuff...
accountname:x:otherstuff

are either system accounts or disabled accounts. You know which accounts
you disabled.

Eric Worrall


> Hi,

> I'm compiling unix & linux account list in my company under linux 6.2,
> 7.0 & digital unix 4 platforms (I'm not the original administrator of
> these servers & no document left behind by previous adminstrator who
> had left).

> As I cat the /etc/passwd file, I found many accounts seem be used by
> OS or system services only. Some of them are very obvious like adm,
> bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
> platform has some unique account names which seem not being used by
> users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
> etc.

> I would like to ask is there any easy way to identify which account is
> human  user account and which being OS / OS service accounts ? Any
> document available on internet to list those common system services
> accounts ?

> Can I based on the initial program or shell that executes to help
> judge this e.g. user accounts will initialize a shell like bash, csh,
> etc while system own accounts will not.

> Tks!

--
You have just recieved an Etech Solution
For all your Linux requirements contact


 
 
 

Easy way to identify system created account or account for system services

Post by lonelyplanet9 » Sat, 20 Jul 2002 15:10:52


Where can I find those well known unix / linux account list information ?

> Yep. System accounts dont have a password. Most modern distros use
> /etc/shadow to hold passwords (you need to be root to see it). The
> format of /etc/shadow is:
> username:password:otherstuff...

> Accounts in /etc/shadow which look like:
> accountname:*:otherstuff...
> accountname:!!:otherstuff...
> accountname:x:otherstuff

> are either system accounts or disabled accounts. You know which accounts
> you disabled.

> Eric Worrall


> > Hi,

> > I'm compiling unix & linux account list in my company under linux 6.2,
> > 7.0 & digital unix 4 platforms (I'm not the original administrator of
> > these servers & no document left behind by previous adminstrator who
> > had left).

> > As I cat the /etc/passwd file, I found many accounts seem be used by
> > OS or system services only. Some of them are very obvious like adm,
> > bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
> > platform has some unique account names which seem not being used by
> > users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
> > etc.

> > I would like to ask is there any easy way to identify which account is
> > human  user account and which being OS / OS service accounts ? Any
> > document available on internet to list those common system services
> > accounts ?

> > Can I based on the initial program or shell that executes to help
> > judge this e.g. user accounts will initialize a shell like bash, csh,
> > etc while system own accounts will not.

> > Tks!

 
 
 

Easy way to identify system created account or account for system services

Post by Eric Worral » Sat, 20 Jul 2002 17:48:38


1. You can tell which accounts are system accounts by check the contents
of /etc/shadow. System accounts and accounts which you explicitly
disabled will have either a *, a !! or x in the password field (i.e.
system accounts dont have a password).

2. The quickest way to determine which account is associated with a
running service is to use the ps command (ps uax on my machine but check
man ps, the options vary on different distros).

3. I dont know any documents which describe the usernames associated
with different services. Note the username / service association is
arbitrary and varies between different distributions and even different
versions of the same distribution.

Sorry if I haven't answered your question, if you explain in more detail
why you need the information I'll have a better understanding of what
you require.

Eric Worrall.


> Where can I find those well known unix / linux account list information ?


> > Yep. System accounts dont have a password. Most modern distros use
> > /etc/shadow to hold passwords (you need to be root to see it). The
> > format of /etc/shadow is:
> > username:password:otherstuff...

> > Accounts in /etc/shadow which look like:
> > accountname:*:otherstuff...
> > accountname:!!:otherstuff...
> > accountname:x:otherstuff

> > are either system accounts or disabled accounts. You know which accounts
> > you disabled.

> > Eric Worrall


> > > Hi,

> > > I'm compiling unix & linux account list in my company under linux 6.2,
> > > 7.0 & digital unix 4 platforms (I'm not the original administrator of
> > > these servers & no document left behind by previous adminstrator who
> > > had left).

> > > As I cat the /etc/passwd file, I found many accounts seem be used by
> > > OS or system services only. Some of them are very obvious like adm,
> > > bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
> > > platform has some unique account names which seem not being used by
> > > users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
> > > etc.

> > > I would like to ask is there any easy way to identify which account is
> > > human  user account and which being OS / OS service accounts ? Any
> > > document available on internet to list those common system services
> > > accounts ?

> > > Can I based on the initial program or shell that executes to help
> > > judge this e.g. user accounts will initialize a shell like bash, csh,
> > > etc while system own accounts will not.

> > > Tks!

--
You have just received an Etech Solution
For all your Linux requirements contact

 
 
 

Easy way to identify system created account or account for system services

Post by lonelyplanet9 » Sun, 21 Jul 2002 01:42:25


For user accounts, I could double check the identity of account owner
with users. But for system accounts, I couldn't find out what's the
use of each of them (alternatively speaking if they are really needed)
if there is no document description of them.

> 1. You can tell which accounts are system accounts by check the contents
> of /etc/shadow. System accounts and accounts which you explicitly
> disabled will have either a *, a !! or x in the password field (i.e.
> system accounts dont have a password).

> 2. The quickest way to determine which account is associated with a
> running service is to use the ps command (ps uax on my machine but check
> man ps, the options vary on different distros).

> 3. I dont know any documents which describe the usernames associated
> with different services. Note the username / service association is
> arbitrary and varies between different distributions and even different
> versions of the same distribution.

> Sorry if I haven't answered your question, if you explain in more detail
> why you need the information I'll have a better understanding of what
> you require.

> Eric Worrall.


> > Where can I find those well known unix / linux account list information ?


> > > Yep. System accounts dont have a password. Most modern distros use
> > > /etc/shadow to hold passwords (you need to be root to see it). The
> > > format of /etc/shadow is:
> > > username:password:otherstuff...

> > > Accounts in /etc/shadow which look like:
> > > accountname:*:otherstuff...
> > > accountname:!!:otherstuff...
> > > accountname:x:otherstuff

> > > are either system accounts or disabled accounts. You know which accounts
> > > you disabled.

> > > Eric Worrall


> > > > Hi,

> > > > I'm compiling unix & linux account list in my company under linux 6.2,
> > > > 7.0 & digital unix 4 platforms (I'm not the original administrator of
> > > > these servers & no document left behind by previous adminstrator who
> > > > had left).

> > > > As I cat the /etc/passwd file, I found many accounts seem be used by
> > > > OS or system services only. Some of them are very obvious like adm,
> > > > bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
> > > > platform has some unique account names which seem not being used by
> > > > users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
> > > > etc.

> > > > I would like to ask is there any easy way to identify which account is
> > > > human  user account and which being OS / OS service accounts ? Any
> > > > document available on internet to list those common system services
> > > > accounts ?

> > > > Can I based on the initial program or shell that executes to help
> > > > judge this e.g. user accounts will initialize a shell like bash, csh,
> > > > etc while system own accounts will not.

> > > > Tks!

 
 
 

Easy way to identify system created account or account for system services

Post by Eric Worral » Sun, 21 Jul 2002 04:21:27


I dont know of any easy way to determine which services are associated
with which system accounts (except for obvious cases such as the ftp
account). On the other hand, system accounts are not of themselves a
security risk, they are usually used to sandbox daemons which would
otherwise have to run with root privileges. Many daemons are initiated
by startup scripts as root and switch ASAP to a less privileged system
account.

You could make your system more secure by minimising the number of
packages and daemons on your system. If it isn't installed it cant be
exploited. Make sure you only run the daemons you really need.

Eric Worrall.


> For user accounts, I could double check the identity of account owner
> with users. But for system accounts, I couldn't find out what's the
> use of each of them (alternatively speaking if they are really needed)
> if there is no document description of them.


> > 1. You can tell which accounts are system accounts by check the contents
> > of /etc/shadow. System accounts and accounts which you explicitly
> > disabled will have either a *, a !! or x in the password field (i.e.
> > system accounts dont have a password).

> > 2. The quickest way to determine which account is associated with a
> > running service is to use the ps command (ps uax on my machine but check
> > man ps, the options vary on different distros).

> > 3. I dont know any documents which describe the usernames associated
> > with different services. Note the username / service association is
> > arbitrary and varies between different distributions and even different
> > versions of the same distribution.

> > Sorry if I haven't answered your question, if you explain in more detail
> > why you need the information I'll have a better understanding of what
> > you require.

> > Eric Worrall.

--
You have just received an Etech Solution
For all your Linux requirements contact

 
 
 

1. Easy way to identify system created account or account for system services

Hi,

I'm compiling unix & linux account list in my company under linux 6.2,
7.0 & digital unix 4 platforms (I'm not the original administrator of
these servers & no document left behind by previous adminstrator who
had left).

As I cat the /etc/passwd file, I found many accounts seem be used by
OS or system services only. Some of them are very obvious like adm,
bin, daemon, lp, news, uucp, games, gopher, ftp, sys, etc. But each
platform has some unique account names which seem not being used by
users e.g. gdm, halt, nobody, nobodyV, nobody4, tcb, ris, wnn, nuucp,
etc.

I would like to ask is there any easy way to identify which account is
human  user account and which being OS / OS service accounts ? Any
document available on internet to list those common system services
accounts ?

Can I based on the initial program or shell that executes to help
judge this e.g. user accounts will initialize a shell like bash, csh,
etc while system own accounts will not.

Tks!

2. changebars (was Re: Word (Text) processors for Linux?)

3. Service/System Accounts

4. ARGH! Samba Printing!

5. Application Development System for Accounting/Invoicing System?

6. SCULPTOR 4GL

7. How to know the total time of using system since his account has created...

8. UFS block allocation for (very) large files

9. power system 830 - System Management Services Graphic

10. system stop at "initializing system services" after compiling Kernel

11. System Accounting

12. AIX Accounting System

13. System accounts