[PLUG] Unknown user?

[Doug Davis]

On Wed, 2002-08-07 at 07:11, Rich Shepard wrote:
> On Wed, 7 Aug 2002, Rich Shepard wrote:
> 
> >   I get warnings in my postfix daily report of a difference between
> > /etc/passwd and /var/spool/postfix/etc/passwe. Turns out that the former has
> > this user entry:
> > 
> > pcap:x:77:77::/var/arpwatch:/sbin/nologin
> > 
> > and the latter doesn't.
> 
>   More info:
> 
>   Looking in /ver/arpwatch/, it appears that this directory (and, perhaps,
> the user 'pcap') are related to ethereal. Wonder if 'pcap' stands for Packet
> CAPture?
> 
> Rich
You are correct sir. Pcap libraries are a requirement for ethereal. This
user also does not have a real login so it wouldn't be indicative of a
crack anyhow.

Doug