user account disappeared

[David Christensen]

On 2/27/21 12:25 PM, Gareth de Vaux wrote:
> Hi all, one of my users in a jail has mysteriously half disappeared. I've renamed the user to 'lostuser', the password hash, and the process it's running to protect privacy below:
> 
> I suddenly can't log in over ssh:
> 
> sshd[22485]: Invalid user lostuser from XYZ
> 
> # su - lostuser
> su: unknown login: lostuser
> 
> # ls -ld /home/lostuser
> drwx------  8 1012  users  18 Jan 23 11:19 /home/lostuser
> 
> $HOME still exists but only showing the userid.
> 
> # egrep "1012|lostuser" /etc/passwd
> lostuser:*:1012:1000:User &:/home/lostuser:/usr/local/bin/bash
> 
> # egrep "1012|lostuser" /etc/master.passwd
> lostuser:$6$9xxxxx/:1012:1000::0:0:User &:/home/lostuser:/usr/local/bin/bash
> 
> Entries are still in /etc/*passwd ?

Are you using NIS, LDAP, Kerberos, etc.?


Is authentication working for root on the console?  Via su(1)?  Via 
local ssh(1)?  Via network ssh(1)?


Is authentication working for lostuser on the console?  Via su(1)?  Via 
local ssh(1)?  Via network ssh(1)?


Is authentication working for other accounts on the console?  Via su(1)? 
  Via local ssh(1)?  Via network ssh(1)?


David