The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Anonymous NFS User added ???? help

Discussion in 'General Discussion' started by sh4ka, Mar 17, 2006.

  1. sh4ka

    sh4ka Well-Known Member

    Joined:
    May 12, 2005
    Messages:
    442
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    US
    cPanel Access Level:
    DataCenter Provider
    I saw this on RootkitHunter logs in lots of my RHES+cPanel servers:

    Checking for differences in user accounts... Found differences
    Info:
    ----------------------
    < nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
    ----------------------
    Info: Some items have been added (items marked with '<')
    Checking for differences in user groups... Found differences
    Info:
    ----------------------
    < nfsnobody:x:65534:


    Is this a security risk or what ? why nfs appeared in my server if I don't use it ???

    thkz.
     
  2. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Minneapolis, MN
    It is possible that rkhunter is not recognizing new or current files, for some odd reason. Try running this command at the prompt and see if that helps:
    ./rkhunter --update
    rkhunter --checkall --skip-keypress

    Run chkrootkit as well and see. That error message could be false-positive. Hope this helps!
     
  3. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    No, that's incorrect.

    It is most likely you're running RHE or CentOS and have just had your OS update upgrade you to the new versions that have come out in the last few days. One of the updates was to the NFS rpms which created that new user.

    Watch your OS mailing lists to keep up to date with such information.
     
  4. dave9000

    dave9000 Well-Known Member

    Joined:
    Apr 7, 2003
    Messages:
    891
    Likes Received:
    1
    Trophy Points:
    16
    Location:
    arkansas
    cPanel Access Level:
    Root Administrator
    Thanks Chirpy, I knew it was due to a update recently but I was pulling my hair out trying to remember which one, what little hair i got left anyway :)
     
  5. sh4ka

    sh4ka Well-Known Member

    Joined:
    May 12, 2005
    Messages:
    442
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    US
    cPanel Access Level:
    DataCenter Provider
    Oh thanks a lot Jonathan Chirpy, it was because of that I upgraded many of my systems on those days :p

    Thank you!

    PD: is a "shark" dog ? (in your avatar)
     
  6. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    My avatar is an english Bull Terrier - we have two of them ;)
     
Loading...

Share This Page