From owner-freebsd-questions Tue Mar 11 15:50:10 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 58F5337B401 for ; Tue, 11 Mar 2003 15:50:09 -0800 (PST) Received: from fep1.cogeco.net (smtp.cogeco.net [216.221.81.25]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4718E43FAF for ; Tue, 11 Mar 2003 15:50:08 -0800 (PST) (envelope-from dlavigne6@cogeco.ca) Received: from dhcp-17-14.kico2.on.cogeco.ca (d226-42-146.home.cgocable.net [24.226.42.146]) by fep1.cogeco.net (Postfix) with ESMTP id CA841A349 for ; Tue, 11 Mar 2003 18:50:04 -0500 (EST) Date: Tue, 11 Mar 2003 18:53:46 -0500 (EST) From: Dru X-X-Sender: dlavigne6@dhcp-17-14.kico2.on.cogeco.ca To: questions@freebsd.org Subject: sfs UID 71 Message-ID: <20030311184600.G89419@dhcp-17-14.kico2.on.cogeco.ca> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I was reading my daily output on a 4.7-RELEASE and noticed the following user was created: > sfs:*:71: as well as the following groups: < nogroup:*:65533: < nobody:*:65534: < sfs:*:71: What was strange was that I hadn't installed or upgraded any applications for at least 2 days. The only thing I had done different was to run "tripwire --check" for the first time on that system. (I had installed tripwire a few weeks earlier but not used it). Am I correct in assuming that tripwire creates that user/groups the first time it is used (rather than installed), or should I investigate further? Dru To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message