Add human users to the KB who never login but have a local account on linux
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
On linux we use recent logins collected via wtmp as a rough approximation of who the human users are on a machine:
https://github.com/google/grr/blob/master/client/client_actions/linux/linux.py#L200
and internally we supplement that with some Google specific user-machine configuration information to get more accuracy. But in a well managed network it isn't unheard of to have machines that no-one logs into, so the users list may be unpopulated in the knowledgebase (KB) for the machine. Which means any artifacts that depend on users.\* will fail.
We have a /etc/passwd artifact, but we don't want to pollute the knowledgebase with lots of system users (e.g. irc, syslog, puppet, ntp etc.), just as we don't count SYSTEM on windows. I think what we need is two sets of users that can be collected and addressed separately.
Contributor guide
Assessment
This issue has not been assessed yet.