I just restarted my mac "OSX El Capitan v10.11.1" and I'm seeing a weird User in my login screen called "puppet":
I have not created this User and I don't know how to log on it.
The most concerning part is that I'm not able to delete it because I can't find it in the System Preferences > Users & Groups:
Neither in the /Users
folder:
$ ls -l /Users/
total 0
drwxr-xr-x+ 11 Guest _guest 374 Nov 23 2013 Guest
drwxrwxrwt 6 root wheel 204 Oct 20 12:00 Shared
drwxr-xr-x+ 80 myuser staff 2720 Dec 7 09:40 myuser
One explanation I can imagine is that the automatization systems management tool I'm using (puppet) has created this weird User.. but the other explanation I can imagine concerns me more: I've been hacked :/
Nothing in /etc/passwd:
$ cat /etc/passwd | grep puppet # -> nothing
This file has been just created, looks like with my last restart:
$ sudo ls -l /var/db/dslocal/nodes/Default/users/puppet.plist
-rw------- 1 root wheel 2775 Dec 7 09:38 /var/db/dslocal/nodes/Default/users/puppet.plist
Have someone an explanation for this? How can I delete that User?