General Questions • Re: [Software] File integrity monitoring paranoia

I monitor my devices with Debian's integrit file integrity monitoring program. Join me on an investigation (that I DEFINITELY want to be doing at 4 AM! *forced smile* Image may be NSFW.
Clik here to view.)!

....
....
This interesting entry for su activity:

Code:

su:    Sessions Opened:       root -> nobody(uid=65534): 3 Time(s)

What is "nobody"? I'm going to have to do some research.

Which command did you run to get this information on open su sessions? And is nobody listed in your sudo file or users file or passwd or shadow file? The UID is pretty unique as it they have taken almost the last ID. Typically users are created have a ID after 1000. This one, i.e. nobody, has an id of 65534.

Statistics: Posted by DebianFox — 2024-06-11 08:29

---