After WHM 110.0.5 update I see 2 new users rpcuser AND nfsnobody

[net@work]

Hello,

Today the cPanel made an update from 108.0.15 to 110.0.5.

Through the update cPanel make a yum installation of nfs-utils. See below:

Creating directory /usr/local/cpanel/Whostmgr/Accounts/Component-cpanelsync
[B]Starting yum execution “--assumeyes --color=never --config /etc/yum.conf install nfs-utils --enablerepo=epel”.[/B]
Creating directory[B] /usr/local/cpanel/Cpanel/NFS-cpanelsync[/B]

--> Running transaction check
---> Package nfs-utils.x86_64 1:1.3.0-0.68.el7.2 will be installed
--> Processing Dependency: gssproxy >= 0.7.0-3 for package: 1:nfs-utils-1.3.0-0.68.el7.2.x86_64
--> Processing Dependency: libnfsidmap for package: 1:nfs-utils-1.3.0-0.68.el7.2.x86_64
--> Processing Dependency: keyutils for package: 1:nfs-utils-1.3.0-0.68.el7.2.x86_64
--> Processing Dependency: libnfsidmap.so.0()(64bit) for package: 1:nfs-utils-1.3.0-0.68.el7.2.x86_64
--> Running transaction check
---> Package gssproxy.x86_64 0:0.7.0-30.el7_9 will be installed
--> Processing Dependency: libini_config >= 1.3.1-31 for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libverto-module-base for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libref_array.so.1(REF_ARRAY_0.1.1)(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libini_config.so.3(INI_CONFIG_1.2.0)(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libini_config.so.3(INI_CONFIG_1.1.0)(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libref_array.so.1()(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libini_config.so.3()(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libcollection.so.2()(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
--> Processing Dependency: libbasicobjects.so.0()(64bit) for package: gssproxy-0.7.0-30.el7_9.x86_64
---> Package keyutils.x86_64 0:1.5.8-3.el7 will be installed
---> Package libnfsidmap.x86_64 0:0.25-19.el7 will be installed
--> Running transaction check
---> Package libbasicobjects.x86_64 0:0.1.1-32.el7 will be installed
---> Package libcollection.x86_64 0:0.7.0-32.el7 will be installed
---> Package libini_config.x86_64 0:1.3.1-32.el7 will be installed
--> Processing Dependency: libpath_utils.so.1(PATH_UTILS_0.2.1)(64bit) for package: libini_config-1.3.1-32.el7.x86_64
--> Processing Dependency: libpath_utils.so.1()(64bit) for package: libini_config-1.3.1-32.el7.x86_64
---> Package libref_array.x86_64 0:0.1.5-32.el7 will be installed
---> Package libverto-libevent.x86_64 0:0.2.5-4.el7 will be installed
--> Running transaction check
---> Package libpath_utils.x86_64 0:0.2.1-32.el7 will be installed
--> Finished Dependency Resolution

[B] Installed: nfs-utils.x86_64 1:1.3.0-0.68.el7.2

Dependency Installed:[/B]
gssproxy.x86_64 0:0.7.0-30.el7_9 keyutils.x86_64 0:1.5.8-3.el7
libbasicobjects.x86_64 0:0.1.1-32.el7 libcollection.x86_64 0:0.7.0-32.el7
libini_config.x86_64 0:1.3.1-32.el7 libnfsidmap.x86_64 0:0.25-19.el7
libpath_utils.x86_64 0:0.2.1-32.el7 libref_array.x86_64 0:0.1.5-32.el7
libverto-libevent.x86_64 0:0.2.5-4.el7

Complete!
[B]Completed yum execution “--assumeyes --color=never --config /etc/yum.conf install nfs-utils --enablerepo=epel”: in 100.953 second(s).[/B]


After the succesfull update to 110.0.5 I had notice that says:

Warning: User 'rpcuser' has been added to the passwd file.
Warning: User 'nfsnobody' has been added to the passwd file.

Warning: Changes found in the group file for group 'mysyslog':
User 'rpcuser' has been added to the group
User 'nfsnobody' has been added to the group

Warning: Group 'rpcuser' has been added to the group file.
Warning: Group 'nfsnobody' has been added to the group file.


And the passwd file containts:

rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin



Is that ok with that update? I don't use any RPC service or NFS. It's ok to leave it as is or I must delete users and groups?

Any advice would be helpful. Thank you!

 

[mtindor]

That seems to be typical upon installation of WHM 110. It's been noted here on the forums.

lfd warning email flood.

Over the last several hours I am being flooded with email such as this one... I get oen for every use on mys erver and they are constant. WTF> Time: Wed Apr 12 17:20:37 2023 +0000 Account: willis Resource: Virtual Memory Size Exceeded: 404 > 350 (MB) Executable...

forums.cpanel.net

rpcbind - lfd excessive resource email

Could be coincidental, but lfd excessive resource email started at the same time cPanel updated to 110.0.1 today. lfd on vps2.aps123.com: Excessive resource usage: rpc (676 (Parent PID:676)) Time: Tue Apr 4 16:35:31 2023 -0600 Account: rpc Resource: Process Time Exceeded: 19867 > 1800 (seconds)...

forums.cpanel.net

My recommendation would be to stop / disable RPCBIND

systemctl stop rpcbind
systemctl disable rpcbind

I'll leave it up to you to decide if you want to do that or not. I disabled RPCBIND on my machines that updated. It's ashame that those were dependencies of nfs-utils though.

 

[net@work]

Hello and thank you for the answer.

I checked if rpcbind is running and no it isn't.

systemctl status rpcbind
● rpcbind.service - RPC bind service
Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; disabled; vendor preset: enabled)
Active: inactive (dead)

Also from the WHM update to 110.0.5 I don't see that package installed.

Also from the yum history I see only be installed:

Dep-Install gssproxy-0.7.0-30.el7_9.x86_64 @updates
Dep-Install keyutils-1.5.8-3.el7.x86_64 @base
Dep-Install libbasicobjects-0.1.1-32.el7.x86_64 @base
Dep-Install libcollection-0.7.0-32.el7.x86_64 @base
Dep-Install libini_config-1.3.1-32.el7.x86_64 @base
Dep-Install libnfsidmap-0.25-19.el7.x86_64 @base
Dep-Install libpath_utils-0.2.1-32.el7.x86_64 @base
Dep-Install libref_array-0.1.5-32.el7.x86_64 @base
Dep-Install libverto-libevent-0.2.5-4.el7.x86_64 @base
Install nfs-utils-1:1.3.0-0.68.el7.2.x86_64 @updates

The question here now is it's safe the user and group that added on system?

rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin


Also the nfs-utils seems be a dependency package for /usr/local/cpanel/Cpanel/NFS-cpanelsync

Why the WHM adds 2 more users (rpcuser AND nfsnobody) from that update?

We must take any measures to secure nfs or what?

I'm a bit confuse...

Any help appreciated! Thank you!

 

[cPRex]

As @mtindor mentiond, these are users that we create. You can find them in our restricted username list here:

https://support.cpanel.net/hc/en-us/articles/4406293107479-Reserved-Invalid-and-Misconfigured-Usernames

There shouldn't be a reason to manually disable or remove those, and rpcbind doesn't get started on many servers, so you're likely all set.

 

[net@work]

Hello @cPRex and thank you for the answer.

I saw before the link here: https://support.cpanel.net/hc/en-us...-Reserved-Invalid-and-Misconfigured-Usernames

But since the table says that the root user have alias the rpcuser AND nfsnobody I thought that would be different from see actually two more entries with these specific users.

I think I misunderstood the Alias and I don't expect see actually users there.

So I will not make any changes as you said are all set and seems work as should.

Thank you again guys!