1

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, because they are not found anymore.

I used the following command to remove the sync user:

userdel -r -f sync

The following error appears after I removed the user:

-bash: shutdown: command not found

why do these commands not work anymore? and is it possible to remove the sync user without any problem?

6
  • I have no idea what you're talking about. There is no user that is required to sync to the disk. The sync() and fsync() syscalls are completely unprivileged. And ls doesn't call it anyway.
    – forest
    Jun 11, 2018 at 13:09
  • I mean the sync system user. If I remove the system user I am not able to call shutdown or ls. Jun 11, 2018 at 13:11
  • What error do you get if you run ls? And a sync user is a historical artifact (like, from the 80s). It is not required to sync to the disk, it is designed to be a dummy user that someone can "log in with" using an empty password to sync the disk even if they do not have an account.
    – forest
    Jun 11, 2018 at 13:12
  • 1
    Please give the source where you've read it, including the year the book was published. Also cite the explanation the book gives why sync should be removed. And show how exactly you've removed the user. Jun 11, 2018 at 13:13
  • @SteffenUllrich I updated the question Jun 11, 2018 at 13:17

1 Answer 1

2

userdel -r -f sync

With the -r option you are not only removing the user but all data below the users home. On my system the users home is /bin:

$ grep ^sync: /etc/passwd
sync:x:4:65534:sync:/bin:/bin/sync

Only, /bin is the place where lots of essential binaries are stored. Thus, it is not surprising if essential functionality gets lost if you remove /bin.

The book suggests to remove the sync user

That's an unusual recommendation. The usual recommendation is to disable shell access for system users like sync or daemon and lock these (i.e. no valid password) which usually is already done on common systems.

7
  • Ouch, good catch. I guess all that's left is for OP to reinstall.
    – forest
    Jun 11, 2018 at 13:32
  • very good hint thanks! So before I remove a user with -r -f I have to check where his/her/its home location is. Jun 11, 2018 at 13:34
  • 1
    @KevinWallis: why do you think so? You've seen where a too clean approach leads too :) Apart from that, it is better to run some process as a less privileged system user than have it run as root. And that's what these users are usually for. Jun 11, 2018 at 13:42
  • 1
    @KevinWallis It all depends on the user. Simply removing users will not really affect the system's security at all. You have to do more than that. For example, removing the audio user and letting pulseaudio take care of audio can improve security a bit if done right, and removing the video user will greatly improve security, but will break hardware-accelerated video decoding and OpenGL.
    – forest
    Jun 11, 2018 at 13:42
  • 2
    "do you have any suggestions for a newer linux hardening book?" - no, but if you want to have a more hardened UNIX system you might just have a look at OpenBSD instead :) Jun 11, 2018 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.