From: Sam Ashley <you@la...> - 2013-05-14 10:17:05
First, thanks for rkhunter!!
Out of the proverbial blue a user and a group both called "ntp" are
reported as having been added to passwd. The strange thing is that it
doesn't seem that I did anything to cause that, I mean specifically
just before these warnings started to be reported by rkhunter. The
first thing I did was to search the interwebs with the specific error
message from rkhunter and didn't get anything back that would indicate
a problem. I did learn that ntp is a mechanism for syncing the
computer's clock, so assuming it's legit then I'd certainly expect that
it's fine for it to be there. I looked through every log I could think
of, including the apt logs (package manager; Ubuntu Studio 12.10)
just to refresh my memory about system updates, and it really does seem
fine, tho I'm no expert. I'm running rkhunter on a laptop, which might
seem over cautious, but to me it seems like a good idea. Sorry if this
question is too n00b for this forum. It was just the fact that I don't
think I installed anything just prior to these messages that would
account for it, so I'm confused by that.
From: Sam Ashley <you@la...> - 2013-05-14 11:11:39
Thanks for your helpful comment. That pretty much settled it as I see
from the output of that that the user was apparently added almost a
month ago. Strange to me that only now would rkhunter start warning me
that it was added. When I say that it's not mean as a complaint; I'm
saying it more out of curiosity. All in all though the appearance of
that user seems fine.
On Tue, 14 May 2013 12:22:48 +0200
"Silvio Knizek" <sknizek@...> wrote:
> Hi Sam,
> passwd -S ntp
> you can see when the user was added. Maybe it helps you.
> Find Top Quality Sites For phones email