Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

someone hacked one of my servers using postgres user account.

what I do not know is:

  • what is this users home folder?

  • where would bash_history be?

share|improve this question
1  
You may also want to ask this on serverfault.com, as that is the server admin site. –  JNK Sep 8 '10 at 12:41

1 Answer 1

up vote 2 down vote accepted

grep postgres /etc/passwd will print you out the home directory for postgres account.

The bash_history would be located in the root of postgres account home directory, for example /home/postgres/.bash_history. But if someone was skilled enough to actually hack your server, don't expect that history file to be accurate or even present any more.

Probably the user account could browse around your filesystem, but of course could not read files like /etc/shadow, unless your server got rooted by using some exploit. He also could have installed some daemons listening for network connections, or for example a irc-bot which connects to IRC and receives the commands from there.

share|improve this answer
1  
getent passwd postgres is usually better, since it doesn't just look up /etc/passwd but all configured databases (LDAP, NIS, Winbind) –  grawity Sep 8 '10 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.