8

I just restarted my mac "OSX El Capitan v10.11.1" and I'm seeing a weird User in my login screen called "puppet":

I have not created this User and I don't know how to log on it.

The most concerning part is that I'm not able to delete it because I can't find it in the System Preferences > Users & Groups:

Neither in the /Users folder:

$ ls -l /Users/
total 0
drwxr-xr-x+ 11 Guest     _guest   374 Nov 23  2013 Guest
drwxrwxrwt   6 root      wheel    204 Oct 20 12:00 Shared
drwxr-xr-x+ 80 myuser    staff   2720 Dec  7 09:40 myuser

One explanation I can imagine is that the automatization systems management tool I'm using (puppet) has created this weird User.. but the other explanation I can imagine concerns me more: I've been hacked :/

Nothing in /etc/passwd:

$ cat /etc/passwd | grep puppet # -> nothing

This file has been just created, looks like with my last restart:

$ sudo ls -l /var/db/dslocal/nodes/Default/users/puppet.plist
-rw-------  1 root  wheel  2775 Dec  7 09:38 /var/db/dslocal/nodes/Default/users/puppet.plist

Have someone an explanation for this? How can I delete that User?

Improve this question
2
  • Is it in /etc/passwd?
    – Cedric H.
    Dec 7, 2015 at 8:53
  • @CedricH. nothing there, check the update
    – fguillen
    Dec 7, 2015 at 8:57

2 Answers 2

Reset to default
5

As per puppet doc for mac installation:

The puppet master service needs a puppet user and group.

So you can be sure now that you haven't been hacked :)

Improve this answer
3
  • 1
    Wow.. the puppet people should put this in red letters all around their website.. it is very weird to see a magic User in your system with such a hacker-likely name :)
    – fguillen
    Dec 7, 2015 at 9:17
  • 3
    Well, if you copy&pasted puppet recipies from random web sites, you will be hacked sooner or later anyway. These recipies have root access...
    – Has QUIT--Anony-Mousse
    Dec 8, 2015 at 8:00
  • @fguillen - I am not surprised they don't as if they understood OS X then the user would not appear. If the user id is less than 500 it does not appear as a login but just as a plain Unix login
    – mmmmmm
    Dec 8, 2015 at 12:27
3

FYI, you can hide this user from the login screen:

sudo dscl . create /Users/puppet IsHidden 1

Or in pre-Yosemite versions:

defaults write  /Library/Preferences/com.apple.loginwindow HiddenUsersList -array-add puppet

Source

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .