Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After performing the regular update of my Ubuntu 10.04.1, and a reboot (because kernel update), I opened a terminal window and entered

  $ su -
  Password: 

  su: Authentication failure
  $
  $ su -
  Password: 
  Added user root.

  # 

(First I entered a wrong password (I think))
I do that all the time but this is the first time I get Added user root.

Does somebody know from where does this message come? Should I worry?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The message probably comes from PAM. Though I can't think of any module that would add a user account just like that. You may want to post /etc/pam.d/su and /etc/pam.d/common-*.

Check /etc/passwd, look for files starting with passwd in /etc. If there aren't any additional ones (especially with dpkg or similar ending) and passwd file doesn't list suspicious users (or more than one user with UID 0) then I think you shouldn't worry.

share|improve this answer
    
The pam.d setup is untouched (by me). Did a grep Added /etc/pam.d/*, result nothing. –  ring0 Sep 30 '10 at 1:41
    
The "added user X" message would be compiled in to a pam module, not written in /etc/pam.d –  Kamil Kisiel Sep 30 '10 at 6:27
    
Thanks. Please see the message I added below (in the other answer). –  ring0 Sep 30 '10 at 14:21

change root password to temporary

Console 1:

$ LC_ALL=C su -
Password: 

Console2:

# strace -fp `pgrep ^su$` 2> ~/strace

Console1:

Enter password and then $ exit

Then mail ~/strace to bindbn at gmail.com

share|improve this answer
    
<code>pam_smbpasswd.so</code> module? Please, post the files I asked you to, it is safe to do. I don't have a Ubuntu 10.04 machine avaiable. –  Hubert Kario Sep 30 '10 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.