1

I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, because they are not found anymore.

I used the following command to remove the sync user:

userdel -r -f sync

The following error appears after I removed the user:

-bash: shutdown: command not found

why do these commands not work anymore? and is it possible to remove the sync user without any problem?

  • I have no idea what you're talking about. There is no user that is required to sync to the disk. The sync() and fsync() syscalls are completely unprivileged. And ls doesn't call it anyway. – forest Jun 11 '18 at 13:09
  • I mean the sync system user. If I remove the system user I am not able to call shutdown or ls. – Kevin Wallis Jun 11 '18 at 13:11
  • What error do you get if you run ls? And a sync user is a historical artifact (like, from the 80s). It is not required to sync to the disk, it is designed to be a dummy user that someone can "log in with" using an empty password to sync the disk even if they do not have an account. – forest Jun 11 '18 at 13:12
  • 1
    Please give the source where you've read it, including the year the book was published. Also cite the explanation the book gives why sync should be removed. And show how exactly you've removed the user. – Steffen Ullrich Jun 11 '18 at 13:13
  • @SteffenUllrich I updated the question – Kevin Wallis Jun 11 '18 at 13:17
2

userdel -r -f sync

With the -r option you are not only removing the user but all data below the users home. On my system the users home is /bin:

$ grep ^sync: /etc/passwd
sync:x:4:65534:sync:/bin:/bin/sync

Only, /bin is the place where lots of essential binaries are stored. Thus, it is not surprising if essential functionality gets lost if you remove /bin.

The book suggests to remove the sync user

That's an unusual recommendation. The usual recommendation is to disable shell access for system users like sync or daemon and lock these (i.e. no valid password) which usually is already done on common systems.

  • Ouch, good catch. I guess all that's left is for OP to reinstall. – forest Jun 11 '18 at 13:32
  • very good hint thanks! So before I remove a user with -r -f I have to check where his/her/its home location is. – Kevin Wallis Jun 11 '18 at 13:34
  • 1
    @KevinWallis: why do you think so? You've seen where a too clean approach leads too :) Apart from that, it is better to run some process as a less privileged system user than have it run as root. And that's what these users are usually for. – Steffen Ullrich Jun 11 '18 at 13:42
  • 1
    @KevinWallis It all depends on the user. Simply removing users will not really affect the system's security at all. You have to do more than that. For example, removing the audio user and letting pulseaudio take care of audio can improve security a bit if done right, and removing the video user will greatly improve security, but will break hardware-accelerated video decoding and OpenGL. – forest Jun 11 '18 at 13:42
  • 2
    "do you have any suggestions for a newer linux hardening book?" - no, but if you want to have a more hardened UNIX system you might just have a look at OpenBSD instead :) – Steffen Ullrich Jun 11 '18 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.