I have tried many setups and many schemas, but after
trying to su or ssh in, the following happens:
read(4, "\4user\6expire\3\v\0\0\1\3\3\1\0\0", 22) = 22
read(4, "\1\0\0\n", 4) = 4
read(4, "\376", 1) = 1
brk(0) = 0x8060000
brk(0x8062000) = 0x8062000
read(4, "3\0\0\v", 4) = 4
read(4, "\34$1$pp$FiHzni87Pc3CeOaG24jZV/\5li"..., 51)
= 51
read(4, "\1\0\0\f", 4) = 4
read(4, "\376", 1) = 1
time(NULL) = 1054579581
time(NULL) = 1054579581
time([1054579581]) = 1054579581
open("/etc/localtime", O_RDONLY) = 5
fstat64(5, {st_mode=S_IFREG|0644, st_size=721, ...}) =
0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x40017000
read(5, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0
\3\0"..., 4096) = 721
close(5) = 0
munmap(0x40017000, 4096) = 0
getpid() = 17530
rt_sigprocmask(SIG_SETMASK, NULL, [RTMIN], 8) = 0
rt_sigsuspend([]