Re: [cobalt-security] Odd entries in passwd file?

["Zeffie" <cobaltlist@xxxxxxxx>]

> Hmm.. Odd because looking in my recent backups (a week ago) they were not
> there..
>
> Any ideas??

it was this rpm...
ftp://www.zeffie.net/cobalt/updates/decompressed/RaQ550/RaQ550-All-Security-0.0.1-16571.pkg/RPMS/nfs-utils-0.3.3-3.i386.rpm

in the update RaQ550-All-Security-0.0.1-16571
we got nfs-utils-0.3.3-3.i386.rpm
and it ran the following

preinstall scriptlet (through /bin/sh):
/usr/sbin/useradd -c "RPC Service User" -r \
        -s /sbin/nologin -u 29 -d /var/lib/nfs rpcuser 2>/dev/null || :
# If UID 65534 is unassigned, create user "nfsnobody"
cat /etc/passwd | cut -d':' -f 3 | grep --quiet 65534 2>/dev/null
if [ "$?" -eq 1 ]; then
        /usr/sbin/useradd -c "Anonymous NFS User" -r \
                -s /sbin/nologin -u 65534 -d /var/lib/nfs nfsnobody
2>/dev/null || :
fi
postinstall scriptlet (through /bin/sh):
/sbin/chkconfig --add nfs
/sbin/chkconfig --add nfslock
preuninstall scriptlet (through /bin/sh):
if [ "$1" = "0" ]; then
    /sbin/chkconfig --del nfs
    /sbin/chkconfig --del nfslock
    /usr/sbin/userdel rpcuser 2>/dev/null || :
    /usr/sbin/groupdel rpcuser 2>/dev/null || :
    /usr/sbin/userdel nfsnobody 2>/dev/null || :
fi

and your looking at the resulting users..  all is good except the spec was
never cobalt-tized... grumble... ...  oh well......

Zeffie
Cobalt RaQ System Administration, Maintenance and Repairs.
http://www.zeffie.com/how_to_contact_zeffie.html 734.454.9117
http://www.zeffie.com/ Home of the Worlds Largest Collection of RaQ rpms
Advanced Cobalt Security, Firewall, Snort, AntiSpam, AntiVirus, etc. GUI's