On 27/01/2019 15.08, Adam Mizerski wrote:
Totally different (and much simpler) question - did you check journal or /var/log/messages? If the user was deleted with "userdel", you should find something about this in the log. If so, check if other events, updates, whatever happened at the same time.
In journal - nothing suspicious (I can share some of my logs privately, if you want). /var/log/messages? Man, I haven't seed that file in ages :)
I grepped whole /var/log with some keywords and all I found is /var/log/audit/audit.log that contains all my useradd actions, but nothing related to deleting freenet user (I checked by name and id).
The user could be deleted by editing the passwd file directly with any editor, leaving no trace. Well, some editors would leave a bak or ~ file. -- Cheers / Saludos, Carlos E. R. (from 15.0 x86_64 at Telcontar)