user account disappeared

[Gareth de Vaux]

On Sun 2021-02-28 (01:23), Yuri Pankov wrote:
> You should remember that authentication generally does NOT use textual
> /etc/passwd and /etc/master.passwd directly and rather relies on
> /etc/spwd.db database (see pwd_mkdb(8)) -- what is the timestamp on it?
> 
> If it's out of sync, recreate the database using:
> 
> /usr/sbin/pwd_mkdb -p /etc/master.passwd
> 
> If that helps, *why* it is out of sync is the real question.

Thanks, I assume that will fix it since the entry is in /etc/*passwd, though I'm
worried if I run pwd_mkdb I'll squash some clues, and yes I'm more concerned with
why this happened.

# ls -l /etc/*pwd.db /etc/*passwd 
-rw-------  1 root  wheel   4092 Jan 23 12:22 /etc/master.passwd
-rw-r--r--  1 root  wheel   2621 Jan 23 12:22 /etc/passwd
-rw-r--r--  1 root  wheel  40960 Jan 23 12:22 /etc/pwd.db
-rw-------  1 root  wheel  40960 Jan 23 12:22 /etc/spwd.db