Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

someone hacked one of my servers using postgres user account.

what I do not know is:

  • what is this users home folder?

  • where would bash_history be?

share|improve this question
You may also want to ask this on, as that is the server admin site. – JNK Sep 8 '10 at 12:41
up vote 2 down vote accepted

grep postgres /etc/passwd will print you out the home directory for postgres account.

The bash_history would be located in the root of postgres account home directory, for example /home/postgres/.bash_history. But if someone was skilled enough to actually hack your server, don't expect that history file to be accurate or even present any more.

Probably the user account could browse around your filesystem, but of course could not read files like /etc/shadow, unless your server got rooted by using some exploit. He also could have installed some daemons listening for network connections, or for example a irc-bot which connects to IRC and receives the commands from there.

share|improve this answer
getent passwd postgres is usually better, since it doesn't just look up /etc/passwd but all configured databases (LDAP, NIS, Winbind) – grawity Sep 8 '10 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .