Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After performing the regular update of my Ubuntu 10.04.1, and a reboot (because kernel update), I opened a terminal window and entered

  $ su -

  su: Authentication failure
  $ su -
  Added user root.


(First I entered a wrong password (I think))
I do that all the time but this is the first time I get Added user root.

Does somebody know from where does this message come? Should I worry?

share|improve this question
up vote 3 down vote accepted

The message probably comes from PAM. Though I can't think of any module that would add a user account just like that. You may want to post /etc/pam.d/su and /etc/pam.d/common-*.

Check /etc/passwd, look for files starting with passwd in /etc. If there aren't any additional ones (especially with dpkg or similar ending) and passwd file doesn't list suspicious users (or more than one user with UID 0) then I think you shouldn't worry.

share|improve this answer
The pam.d setup is untouched (by me). Did a grep Added /etc/pam.d/*, result nothing. – ringø Sep 30 '10 at 1:41
The "added user X" message would be compiled in to a pam module, not written in /etc/pam.d – Kamil Kisiel Sep 30 '10 at 6:27
Thanks. Please see the message I added below (in the other answer). – ringø Sep 30 '10 at 14:21

change root password to temporary

Console 1:

$ LC_ALL=C su -


# strace -fp `pgrep ^su$` 2> ~/strace


Enter password and then $ exit

Then mail ~/strace to bindbn at

share|improve this answer
<code></code> module? Please, post the files I asked you to, it is safe to do. I don't have a Ubuntu 10.04 machine avaiable. – Hubert Kario Sep 30 '10 at 14:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.