Well, you could have told me

When looking through some of the configuration options on my laptop (well, it’s either that or go to the pub and socialise with humans) I came across something I couldn’t account — pardon the pun — for. A new user account on the system, short name messagebus, full name "Message Bus" user id 506. Now messagebus looks like the name of a system daemon user, but that full name looks like some clueless skiddie made a mistake creating the user account, especially as the uid is that of a regular user. That’s the kind of mistake no self-respecting installer would make.

So, what had this phantom user done? Well, thankfully, nothing. Neither the shell nor home directory was real, and wtmp/utmp showed no activity. Neither did the ssh logs – but in looking for them I realised that I don’t actually use ssh on the box, so turned it off.

Anyway, it turned out to be an innocuous issue – the MacPorts installer for dbus creates this bogus user, which I’ve since deleted. This Apple forums discussion explains more.

This entry was posted in macports, security, sysadmin. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.