The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Wheel Group users (where do they come from?)

Discussion in 'Workarounds and Optimization' started by jayd, Feb 10, 2005.

  1. jayd

    jayd Registered

    Joined:
    Feb 8, 2005
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    There are a lot of users in the list that i did not create and do not see anywhere else in cpanel/whm. Where do these usernames come from? Thanks!
     
  2. dgbaker

    dgbaker Well-Known Member
    PartnerNOC

    Joined:
    Sep 20, 2002
    Messages:
    2,578
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Toronto, Ontario Canada
    cPanel Access Level:
    DataCenter Provider
    That list of users that can be added is generated from the /etc/passwd file. It contains all accounts including system accounts like: daemon, bin, lp, sync, etc......

    As long as root, cpanel and any that you put are the only ones in
    "Users Currently in the wheel group" list you should be fine.
     
  3. jayd

    jayd Registered

    Joined:
    Feb 8, 2005
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Ah ha

    That makes sense.

    There is a user in there called uisername ... spelled exactly like that. Where would that have come from? Does anybody else have that in their list?

    Thanks
     
  4. dezignguy

    dezignguy Well-Known Member

    Joined:
    Sep 26, 2004
    Messages:
    534
    Likes Received:
    0
    Trophy Points:
    16
    First are you sure it's actually in the wheel group list? If you're looking at the Manage Wheel Group Users section in WHM, it can be kinda confusing at first glance... and you might think all those usernames are in the wheel group, when it's actually just asking you if you want to add one of those users. See the top box that says "Users Currently in the wheel group", for users that are actually in the group.

    If you did see it correctly, and that username is actually in the wheel group list, and you didn't put it there and you're the admin for the box, then you probably have a compromised/hacked/rooted server.

    If that username is not on the wheel group list, but you didn't put it there and don't know how it got there, then you might have a problem as well... with varying degrees of badness. Other than the default system accounts (you can likely find a list of them somewhere), the only other ones should be cpanel related daemons (cpanel and mailman, named, mysql, apache, etc), and then the main usernames for your accounts. Do you have any accounts with this username? Did you create this user through the command line?

    You may want to consider hiring a competent server-admin to check things out for you and secure/optimize your server.
     
Loading...
Similar Threads - Wheel Group users
  1. sahostking
    Replies:
    2
    Views:
    578

Share This Page