Anonymous NFS User added ???? help

[sh4ka]

I saw this on RootkitHunter logs in lots of my RHES+cPanel servers:

Checking for differences in user accounts... Found differences
Info:
----------------------
< nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
----------------------
Info: Some items have been added (items marked with '<')
Checking for differences in user groups... Found differences
Info:
----------------------
< nfsnobody:x:65534:


Is this a security risk or what ? why nfs appeared in my server if I don't use it ???

thkz.

[AndyReed]

----------------------
< nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
----------------------
Info: Some items have been added (items marked with '<')
Checking for differences in user groups... Found differences
Info:
----------------------
< nfsnobody:x:65534:

It is possible that rkhunter is not recognizing new or current files, for some odd reason. Try running this command at the prompt and see if that helps:
./rkhunter --update
rkhunter --checkall --skip-keypress

Run chkrootkit as well and see. That error message could be false-positive. Hope this helps!

[chirpy]

No, that's incorrect.

It is most likely you're running RHE or CentOS and have just had your OS update upgrade you to the new versions that have come out in the last few days. One of the updates was to the NFS rpms which created that new user.

Watch your OS mailing lists to keep up to date with such information.

[dave9000]

Thanks Chirpy, I knew it was due to a update recently but I was pulling my hair out trying to remember which one, what little hair i got left anyway

[sh4ka]

Oh thanks a lot Jonathan Chirpy, it was because of that I upgraded many of my systems on those days

Thank you!

PD: is a "shark" dog ? (in your avatar)

[chirpy]

My avatar is an english Bull Terrier - we have two of them