Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
    root# /usr/sbin/sshd
    Privilege separation user sshd does not exist

    root# tcpdump -i eth0 udp  
    tcpdump : Couldn't find user 'tcpdump'

but the users tcpdump and sshd are in the files /etc/shadow and /etc/passwd

   root # cat /etc/passwd
   root:0:0:root:/root:/bin/bash
   bin:1:1:bin:/bin:/sbin/nologin
   daemon:2:2:daemon:/sbin:/sbin/nologin
   ftp:14:50:FTP User:/var/ftp:/sbin/nologin
   oprofile:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
   tcpdump:72:72::/:/sbin/nologin
   sshd:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
   named:25:25:Named:/var/named:/sbin/nologin
   qmaild:505:504::/var/qmail:/bin/false
   qmaill:506:504::/var/qmail:/bin/false
   qmailp:x:507:504::/var/qmail:/bin/false
   qmailq:x:508:505::/var/qmail:/bin/false
   qmailr:x:509:505::/var/qmail:/bin/false
   qmails:x:510:505::/var/qmail:/bin/false
   apache:x:48:48:Apache:/var/www:/sbin/nologin
   mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
   dump:x:0:0::/tmp:/bin/dumpsh

   root # cat /etc/shadow
   root1$eigU8oI6$jYOcUeV1dunekVie/GWeL0:15264:0:99999:7:::
   dump1$mJQ/PAm7$t0JvrCVFDW2I/m2quQSd90:15391:0:99999:7:::
   bin:*:14789:0:99999:7:::
   daemon:*:14789:0:99999:7:::
   ftp:*:14789:0:99999:7:::
   oprofile:!!:14946::::::
   tcpdump:!!:14946::::::
   sshd:!!:14946::::::
   named:!!:122391:0:99999:7:::
   apache:!!:15191::::::
   mysql:!!:15191::::::

If there were someone know how to solve this problem,please help me. Thank you very much.

share|improve this question
    
use strace tcpdump -i eth0 udp like that you can see why you see that error –  c4f4t0r Aug 22 '13 at 9:50
    
For sshd you may need to edit file /etc/ssh/sshd_config and "UsePrivilegeSeparation yes" to "UsePrivilegeSeparation no" OR Edit /etc/passwd and make the cnages as below sshd:x:74:74:privilege-separated SSH:/var/empty/sshd:/sbin/nologin and add this line into /etc/group /etc/group:sshd:*::74: Same you can do it for tcpdump. Hope this works for you –  PratapSingh Aug 22 '13 at 10:07
    
@c4f4t0r I have been seen the code of tcpdump,the reason why the error appears is code "pw = getpwnam(username)" return pw = NULL.The function getpwnam couldn't find 'usernme' in /etc/passwd. –  Ren Yong Aug 22 '13 at 10:40
    
@PratapSingh Thank you.I will have a try. –  Ren Yong Aug 22 '13 at 10:44
1  
It's never a good idea to post your passwords (even if hashed) publicly, btw. –  sendmoreinfo Aug 22 '13 at 19:03

1 Answer 1

I don't know if it's some text formatting weirdness but I thought I point it out:

sshd:74:74rivilege-separated SSH:/var/empty/sshd:/sbin/nologin

should read

sshd:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin

Not sure if this could cause problems like that but if it isn't a formatting error it is definitely worth looking at.

share|improve this answer
    
I'm so sorry, this is my fault.I copied fault.It is correct originally. Thank you. –  Ren Yong Aug 22 '13 at 10:33
    
maybe you usually edit the user information by hand, use the OS command like usermod ......... –  c4f4t0r Aug 22 '13 at 11:54
    
@c4f4t0r Thank you. –  Ren Yong Aug 23 '13 at 2:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.