I got a very strange email today about now account [root]. It says “New account [root] has been created with uid:[0] gid:[0] login:[/root] shell:[/bin/bash]” while there has been no new users registering on my server. Nothing seems to be compromised and below is the rest of the code:
grep ‘0:0’ /etc/passwd
root:x:0:0:root:/root:/bin/bash
chage -l root
Last password change : never
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
What might be causing this?
