(null) user magically appeared in /etc/passwd

From: XeniXman (googlegroups_at_systemjanitor.com)
Date: 09/26/05 

Date: 26 Sep 2005 12:48:00 -0700

The business was closed yesterday (Sunday) when the following line
"appeared" in the /etc/passwd at 8:35am.

(null):x:0:0:(null):(null):(null)

I know that

(1) that line wasn't there on Friday because I added a user in the
afternoon. this "(null)" user appears 36 hours after my last added
user and the file date stamp is 8:35 Yesterday.

(2) everyone with root authority has been contacted. Nobody was in the
system yesterday.

(3) powerchute reboots the server every Sunday at 8am. The system was
fully booted at 8:24am, therefore the change to /etc/passwd happened 11
minutes after the system was booted.

I ran an authck, and found that the (null) user was not part of the
protected database ... FWIW. The system was rebooted since then, so I
can't use the "last" command to see who logged in. They have an
internet connection, but the firewall prevents all inbound connection
to the Unix server. I can telnet and ftp out however.

Nothing odd appears in the /usr/adm/messages or syslog files.

Does this look familiar to anyone? I've worked with SCO for 10,000
years, and this is the first time I've seen (null) in the /etc/passwd,
and the first time a user appeared as if from a divine power.

thanks

System Info:

MenuPort Interface (MPI) Package (ver 4.2.0)
Netscape Communicator (ver 4.7.0e)
SCO Advanced File and Print Server 4.0 (ver 4.0.2)
SCO OpenServer Enterprise System (ver 5.0.6j)
SCO Symmetrical Multiprocessing (ver 1.1.1Ga)
SCO AFPS 4.0.2 Supplement APP619B (ver 1.0)

*The system has been running without problem for years. No new
software has been installed for over a year.

Relevant Pages

  • Re: Does samba 3.0.14Aa on OS 5.0.6 work with ldapsam backend on another LDAP server?
    ... used 3.0.9 on SCO 5.0.6 for quite some time after suffering problems I ... a RedHat4 box running samba 3.0.10 and OpenLDAP 2.2.13. ... and no LDAP server (although there were the ... share on the SCO server without any smbpasswd on that server! ...
    (comp.unix.sco.misc)
  • Re: Fallout from the SCO suits
    ... >> Microsoft until their ears bled cash. ... It's obvious that anyone still running their business on an SCO ... intention of developing for MS products and running on IIS+SQL Server. ... Every MSCE I've worked with - without exception - has been a bumbler. ...
    (comp.unix.sco.misc)
  • Re: Where to find SCO Termlite?
    ... Where to find SCO Termlite? ... I use putty myself as a developer and admin and only when I don't need certain features that my application relies on that various commercial emulators have. ... Because the seats are licenced on the server instead of in the client, the client is free and freely downloadable redistributable, You can put a link to the installer right on a web page next to a "login" button, and the user never sees anything like a license number or serial number or registration. ...
    (comp.unix.sco.misc)
  • Re: Where to find SCO Termlite?
    ... Where to find SCO Termlite? ... licenced on the server instead of in the client, ... There are a few Java emulators out that that make it possible to be as easy ...
    (comp.unix.sco.misc)
  • Re: Running a query on the Back End
    ... Also you can build the same on VB, and run it as a service on your server. ... > updated from SCO tables which would be linked to that same Back End. ... and just activate/run the BackEnd's update/append queries to ...
    (microsoft.public.access.modulesdaovba)