3

After performing the regular update of my Ubuntu 10.04.1, and a reboot (because kernel update), I opened a terminal window and entered

  $ su -
  Password: 

  su: Authentication failure
  $
  $ su -
  Password: 
  Added user root.

  #

(First I entered a wrong password (I think))
I do that all the time but this is the first time I get Added user root.

Does somebody know from where does this message come? Should I worry?

Déjà vu
  • 5,546
  • 9
  • 36
  • 55

2 Answers2

3

The message probably comes from PAM. Though I can't think of any module that would add a user account just like that. You may want to post /etc/pam.d/su and /etc/pam.d/common-*.

Check /etc/passwd, look for files starting with passwd in /etc. If there aren't any additional ones (especially with dpkg or similar ending) and passwd file doesn't list suspicious users (or more than one user with UID 0) then I think you shouldn't worry.

Hubert Kario
  • 6,361
  • 6
  • 36
  • 65
1

change root password to temporary

Console 1:

$ LC_ALL=C su -
Password:

Console2:

# strace -fp `pgrep ^su$` 2> ~/strace

Console1:

Enter password and then $ exit

Then mail ~/strace to bindbn at gmail.com

bindbn
  • 5,211
  • 2
  • 26
  • 24
  • pam_smbpasswd.so module? Please, post the files I asked you to, it is safe to do. I don't have a Ubuntu 10.04 machine avaiable. – Hubert Kario Sep 30 '10 at 14:29