Unsolved mystery – I was given a coworker's Ubuntu 12.04.1 LTS machine and set up my own (sudo/admin) user on there from the command line. I switched to my user (from his sudo/admin user) and confirmed everything was okay using the groups command and the /etc/passwd file looked great. After months of everything working perfectly, a power outage shut down the machine for the first time since I inherited it.
After booting, my new user disappeared. It's not in the /etc/passwd file and there is no entry in the /home directory. I created the user the same as I did before, and there were no errors to indicate that the user still existed.
What happened?
As requested, here is the output of
olduser@machine:~$ ls -lait /home
total 16
3408126 drwxr-xr-x 2 newuser newuser 4096 Nov 20 10:28 newuser
3407873 drwxr-xr-x 4 root root 4096 Nov 20 10:28 .
3407874 drwxr-xr-x 36 coworker coworker 4096 Nov 20 10:00 bvillupu
2 drwxr-xr-x 26 root root 4096 Oct 3 2012 ..
3408259 lrwxrwxrwx 1 root root 44 Aug 9 2012 .directory -> /etc/kubuntu-default-settings/directory-home
Best Answer
I know this doesn't answer your question but if the user was missing from
/etc/passwdthen someone withsudo/rootaccess at some time deleted the user. Being that the user's home directory was also missing gives me the impression that someone ran a not only did auserdelthey did arm -rf /home/user. That implies that there was intent to delete. You can check thesecurefile in/var/logto see if, in fact, someone deleted the user.