Mysterious Samba user appearing in Fedora Graphical Dialog

[Gilbo]

I've got an odd thing going on in one of my servers. A user named "WARNING" has become available in the Samba Users dialog of the graphical interface for Samba.

"WARNING" does not exist in /etc/samba/smbusers. The Unix name is apparently also "WARNING", but the user does not have a home directory. It is not associated with any groups in /etc/group when I do cat /etc/group | grep WARNING.

Is this some weird Fedora/Red Hat thing I don't know about? WTF?

 

[blakerwry]

I've never seen that user and I administer a lot of Fedora/CentOS boxes... can you tell when the user was added ? (/var/log/secure)

 

[Gilbo]

[root@Wittgenstein ~]# cat /var/log/secure | grep WARNING
[root@Wittgenstein ~]#

There doesn't seem to be any mention of the user there.

How can I check if they're a real user (and it's not some wierd bug in the Samba Config GUI)? There's no mention of the user in /etc/group, nor in /etc/samba/smbusers... If he was a UNIX user where we he absolutely have to show up?

EDIT: I tried to ssh into the box as "WARNING":

Jul 11 12:02:00 Wittgenstein sshd[7595]: Invalid user WARNING from 192.168.10.50
Jul 11 16:02:00 Wittgenstein sshd[7596]: input_userauth_request: invalid user WARNING
Jul 11 12:02:06 Wittgenstein sshd[7595]: pam_succeed_if(sshd:auth): error retrieving information about user WARNING
Jul 11 12:02:08 Wittgenstein sshd[7595]: Failed password for invalid user WARNING from 192.168.10.50 port 50643 ssh2

So maybe it's some wierd bug in the Samba GUI config? (Deep down 'm just worried some punk somehow got access to this box... Maybe I'm being paranoid?)

 

[blakerwry]

oh, I thought you had concluded that he was a unix user... unix user accounts are in /etc/passwd, and on newer systems also /etc/shadow