[PLUG] Unknown user?
Alan
alan at clueserver.org
Wed Aug 7 17:15:51 UTC 2002
On Wed, 2002-08-07 at 06:34, Rich Shepard wrote:
> I get warnings in my postfix daily report of a difference between
> /etc/passwd and /var/spool/postfix/etc/passwe. Turns out that the former has
> this user entry:
>
> pcap:x:77:77::/var/arpwatch:/sbin/nologin
>
> and the latter doesn't.
>
> I did not add this "user" myself so I'm curious why it's there and what
> program installed it.
Looks like you installed arpwatch after you installed postfix.
If you are not using arpwatch, you should uninstall it. It forces your
network card into promiscuous mode.
More information about the PLUG
mailing list