Home / server / Questions / 186043
Accepted
Déjà vu
Asked: 2010-09-30 17:21:23 +0800 CST

Strange message after su

  • 772

After performing the regular update of my Ubuntu 10.04.1, and a reboot (because kernel update), I opened a terminal window and entered

  $ su -
  Password: 

  su: Authentication failure
  $
  $ su -
  Password: 
  Added user root.

  #

(First I entered a wrong password (I think))
I do that all the time but this is the first time I get Added user root.

Does somebody know from where does this message come? Should I worry?

ubuntu root su

2 Answers

  1. Best Answer

    The message probably comes from PAM. Though I can't think of any module that would add a user account just like that. You may want to post /etc/pam.d/su and /etc/pam.d/common-*.

    Check /etc/passwd, look for files starting with passwd in /etc. If there aren't any additional ones (especially with dpkg or similar ending) and passwd file doesn't list suspicious users (or more than one user with UID 0) then I think you shouldn't worry.

    • 3

  2. change root password to temporary

    Console 1:

    $ LC_ALL=C su -
Password:

    Console2:

    # strace -fp `pgrep ^su$` 2> ~/strace

    Console1:

    Enter password and then $ exit

    Then mail ~/strace to bindbn at gmail.com

    • 1