-1

I am using Ubuntu 12.04. Recently, lots of new qmail accounts started appearing at the login screen. Excluding my account, 6 new users viz qmaill, qmailr, qmailr, qmails, qmailp and alias are now visible.

The last command on each user shows that the last login was on Fri Nov 2 12:12:07 2012 and the passwd -S for each user is L 11/03/2012 0 99999 7 -1

Does this mean my system has been compromised? If so, how would I track the attacker? I am inside a wired campus LAN.

Monty Swanson
  • 103
  • 2
  • why am I getting a downvote for this?? – Monty Swanson Nov 03 '12 at 19:33
  • Have those users logged in at all since the 2nd and do they have passwords in `/etc/shadow` or SSH keys in their home directories? If they can't log in remotely, I would assume @mgorven's answer is correct. – Ladadadada Nov 06 '12 at 08:39

1 Answers1

1

The qmail-uids-gids package creates these user accounts, although they shouldn't appear on the login screen since they are system accounts. You or someone with access to your system probably installed qmail causing these accounts to be created.

mgorven
  • 30,615
  • 7
  • 79
  • 122