How do I find out when and by whom a particular user was deleted in linux?

Posted by executor21 on Super User See other posts from Super User or by executor21
Published on 2010-12-28T20:06:40Z Indexed on 2010/12/28 20:56 UTC
Read the original article Hit count: 176

Filed under:

linux

|

user-accounts

|

history

|

audit

I've recently ran into a very odd occurrence on one system I'm using. For no apparent reason, my user account was deleted, although the home directory is still there.

I have root access, so I can restore the account, but first, I want to know how this happened, and exactly when. Inspecting the root's .bash_history file and the "last" command gave nothing, and I'm (well, was) the only sudoer on the system.

How would I know when this deletion happened?

The distro is CentOS release 5.4 (Final), if that helps.

© Super User or respective owner

Related posts about linux

apt-get install and update fail

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I've got a problem with apt-get update and apt-get install ... commands . every time update or installing fails and errors are : Get:1 http://dl.google.com stable Release.gpg [198B] Ign http://dl.google.com/linux/chrome/deb/ stable/main Translation-en_US Get:2 http://dl… >>> More
kernel module compiling error

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
sh@ubuntu:/home/ccpp/helloworld$ make gcc-4.6 -O2 -DMODULE -D_KERNEL_ -W -Wall -Wstrict-prototypes -Wmissing-prototypes -isystem /lib/modules/`uname -r`/build/include -c -o hello-1.o hello-1.c hello-1.c:4:0: warning: "MODULE" redefined [enabled by default] <command-line>:0:0: note: this is… >>> More
Build-Essentials installation failing

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am having trouble accessing the several critical header files that show to be a part of the build process. The "Ubuntu Software Center" shows "Build Essentials" as installed: Next I did the following two commands, which did not improve the problem: ~$ sudo apt-get install build-essential [sudo]… >>> More
Updating Debian kernel

as seen on Super User - Search for 'Super User'
I'm trying to update my Debian machine to 2.6.32-46 (which is the new stable). However, after doing apt-get update my apt-cache search linux-image shows me: linux-headers-2.6.32-5-486 - Header files for Linux 2.6.32-5-486 linux-headers-2.6.32-5-686-bigmem - Header files for Linux 2.6.32-5-686-bigmem linux-headers-2… >>> More
Serial connection over a single USB cable (Windows to linux, or linux to linux)

as seen on Server Fault - Search for 'Server Fault'
I'm helping out with a project for an embedded device that only has USB and no serial. This device is running Linux. These days, when we need to connect to a serial port on a device we typically use a USB to serial adapter (on something like a phone system or a load balancing device, etc). I would… >>> More

Related posts about user-accounts

Prevent Windows 7 User Accounts from accessing files in other User Accounts

as seen on Super User - Search for 'Super User'
I'm trying to set up another User Account on my Windows 7 Professional laptop for use by another person. I do not want that person to have access to any of the files in my User Account on the same machine. This machine has a single hard disk formatted with NTFS. User accounts data is stored in the… >>> More
JPA entities -- org.hibernate.TypeMismatchException

as seen on Stack Overflow - Search for 'Stack Overflow'
Environment: JDK 1.6, JEE5 Hibernate Core 3.3.1.GA, Hibernate Annotations 3.4.0.GA DB:Informix Used reverse engineering to create my persistence entities from db schema [NB:This is a schema in work i cannot change] Getting exception when selecting list of basic_auth_accounts org.hibernate.TypeMismatchException:… >>> More
List of Hidden / Virtual Windows User Accounts

as seen on Super User - Search for 'Super User'
I’m trying to find a way to get a comprehensive list of user accounts on a Windows 7 system, including hidden ones. The User Accounts dialog (>control userpasswords2) only shows the normal user accounts, and even the Local User and Groups editor only shows normal user accounts and standard hidden/disabled… >>> More
Creating Limited User Accounts on Ubuntu Server

as seen on Server Fault - Search for 'Server Fault'
Using Ubuntu server, I need to create some user accounts that have the following limitations: (1) User may only view and manipulate files in their home directory. (2) User may only execute commands related to rsync and sftp. I want users to be able to backup files using rsync, and I want them to… >>> More
Active Directory using Samba/Open LDAP for user accounts

as seen on Server Fault - Search for 'Server Fault'
I know this is the wrong way round... but Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP. Managing our fleet of Windows PC's is becoming more and more difficult with just Samba v3 - until Samba v4 comes along, it would be great if… >>> More