Re: Eumongoid lastlog file
Bob,
First, a 10k (actual) lastlog isn't a great burden to go forward with.
Second, if you do decide to eliminate qmail (btw, it creates 7 users:
alias, qmaild, qmaill, qmailp, qmailq, qmailr and qmails) you might want
to run
dpkg --status qmail
to make sure it's not installed as your mail-transport-agent (MTA). If
it's not installed, then probably the qmail users are just leftovers
from a broken or partially removed qmail install.
Also, try running
dpkg --status sendmail
to see if the most likely other MTA is installed. You'll need some MTA
installed to transport mail on your system.
Then, _maybe_ AYOR, 'userdel' the qmail users, or perhaps better run
dpkg --purge qmail
But still check /etc/passwd to see if the qmail guys are gone.
_However_, let /var/log/lastlog take care of itself. Also,
/var/log/faillog which shows the same odd behavior. They may not
automatically regenerate themselves if you rm them, and they are logs
you want to be able to check if you think your security may have been
breached (even though experienced crackers will diddle with them to
cover their tracks).
If I sound like I 'know-it-all', Bob, I don't. It was only about a month
ago I posted to this list with the subject line:
"Help! my /var/log/lastlog's as big as Canarsie!"
and Miquel van Smoorenburg set me on the path to exploring the mysteries
of what he termed Unix's 'sparse files'.
The inflated results from 'ls -l' still won't go away even if you delete
the high UID users, but they should diminish. For instance, on my Red
Hat box where the highest UID is 527, 'ls -l /var/log/lastlog' shows a
153952 filesize and 'du -k /var/log/lastlog' shows actual disk usage at
4k, a 38.5 to 1 inflation.
As they say in Wonderland, "Curiouser and curiouser!", hey?
montefin
Bob Bernstein wrote:
>
> montefin <montefin@finux.com> wrote:
>
> > Is it possible you have an application like qmail which Debian requires
> > to have exceptionally high numbered UID's? Like say upwards of 65000?
> > /etc/passwd will show you your UID range.
>
> You would have won that bet too: <g>
>
> alias:x:70:65534:qmail alias:/var/qmail/alias:/bin/sh
> qmaild:x:71:65534:qmail daemon:/var/qmail:/bin/sh
>
> Funny thing, I don't ever remember installing qmail; otoh this box probably
> goes back through a series of upgrades and drive copying to bo or hamm...
>
> Can I dump those two passwd entries, and delete the lastlog so it'll start
> over, or shouldn't I worry about it? (Seeing that I haven't noticed it in the
> several years there's been Debian on this machine, I wonder why even ask!)
>
> --
> Bob Bernstein http://www.ruptured-duck.com
>
Reply to: