Well, you could have told me

When looking through some of the configuration options on my laptop (well, it’s either that or go to the pub and socialise with humans) I came across something I couldn’t account — pardon the pun — for. A new user account on the system, short name messagebus, full name "Message Bus" user id 506. Now messagebus looks like the name of a system daemon user, but that full name looks like some clueless skiddie made a mistake creating the user account, especially as the uid is that of a regular user. That’s the kind of mistake no self-respecting installer would make.

So, what had this phantom user done? Well, thankfully, nothing. Neither the shell nor home directory was real, and wtmp/utmp showed no activity. Neither did the ssh logs – but in looking for them I realised that I don’t actually use ssh on the box, so turned it off.

Anyway, it turned out to be an innocuous issue – the MacPorts installer for dbus creates this bogus user, which I’ve since deleted. This Apple forums discussion explains more.

Liked it? Take a second to support Graham Lee on Patreon!
This entry was posted in macports, security, sysadmin. Bookmark the permalink.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.