Strange occurence...

[Eric Eisenhart]

On Tue, Oct 29, 2002 at 05:21:51PM -0800, Christopher Wagner wrote:
> I ran up2date yesterday on my Redhat 7.2 box..  Today I see a new user was
> added that I did not create..  My paranoia kicked in BIG TIME..  I'm
> wondering whether this user is part of the updates I received or whether
> this machine has been compromised:
> --
> vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
> --

I'll bet that /dev/vcsa* is all owned by vcsa; I think it's part of the dev
or MAKEDEV update.  Somebody else I know noticed the same user being
created.  Same thing'll happen when you install certain new packages. 
libpcap creates a "pcap" user, for instance.
-- 
Eric Eisenhart                                  eric-dot-sig at eisenhart.com
Perl, SQL, Linux and Web            ^               IRC: Freiheit at freenode
Coder, Sysadmin and geek           /e\                AIM: falsch freiheit
http://eric.eisenhart.com/         ---                       ICQ: 48217244