google / google/grr

Add human users to the KB who never login but have a local account on linux

Open
#281 0 comments 0 reactions 0 assignees View on GitHub
enhancement Priority-Low
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

On linux we use recent logins collected via wtmp as a rough approximation of who the human users are on a machine:
https://github.com/google/grr/blob/master/client/client_actions/linux/linux.py#L200

and internally we supplement that with some Google specific user-machine configuration information to get more accuracy. But in a well managed network it isn't unheard of to have machines that no-one logs into, so the users list may be unpopulated in the knowledgebase (KB) for the machine. Which means any artifacts that depend on users.\* will fail.

We have a /etc/passwd artifact, but we don't want to pollute the knowledgebase with lots of system users (e.g. irc, syslog, puppet, ntp etc.), just as we don't count SYSTEM on windows. I think what we need is two sets of users that can be collected and addressed separately.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.