Have I been hacked?

K

kalantna

Registered
First off, I went against recommendations and was logged into my system as the root user. Bad idea, yadda yadda. Because I do not have a zip drive yet I had to enable file sharing to log onto my computer from another mac on the network with zip so I could transfer the files needed.

I got back to my computer (forgetting to turn file sharing off) and started working. After about 15 min. my screen went blue and I couldn't do anything. When I restarted the startup screen appeared minus the "Welcome to Mac OS X" messages. Still had the status bar and graphic though. It wouldn't boot into the system completely. I finally had to reinstall OS 10.1.2 (I was on 10.1.5). After reinstalling I decided that I would disable the root user so I went to System Prefs> users to set my self up with an admin account. Once there I discovered a new user called sendmail in the list.

So, I ask was I hacked? Keep in mind I'm a Unix newbie so I don't know all the protocols yet.
 
Protocol says: Don't be logged in as root. I don't believe you were hacked. Sendmail is a 'user' itself. In Terminal 'finger sendmail':

[whatever] fryke% finger sendmail
Login: smmsp Name: Sendmail User
Directory: /private/etc/mail Shell: /dev/null
Never logged in.
No Plan.

"Shell:" tells you whether the user can login via SSH/Telnet. /dev/null would mean no, as the user won't get a prompt. Sendmail is a mail-server daemon on your system, and no: 'daemon' isn't something bad. :p
 
you could also open up a terminal and type "last" to determine who has ecently logged into your machine.
 
it *wouldn't* only appear after the incident, i believe. it should be there from the beginning. also, a system update like 10.1.5 could change some things around in the netinfo user database.
 
the new sendmail user is probably due to the unix built in function that sends system crash logs to you via email. Since your system crashed, sendmail was most likely trying to send you the logs, etc... I wouldn't worry about that user, and no, I don't think you were haked. Just be more careful about File sharing next time ;)
 
You must log in or register to reply here.
Back
Top