https://u-random.dev/tags/post-mortem/Recent content in Post-Mortem on u-randomHugo -- gohugo.ioit-itWed, 25 Mar 2026 00:00:00 +0000https://u-random.dev/blog/utente-cancellato-non-abbastanza/Wed, 25 Mar 2026 00:00:00 +0000https://u-random.dev/blog/utente-cancellato-non-abbastanza/<p> </p> <div style="border-left:3px solid #6366f1;background:rgba(99,102,241,0.06);padding:12px 16px;border-radius:0 6px 6px 0;margin:1.5rem 0;"> <div style="font-size:0.7rem;font-weight:800;letter-spacing:0.1em;color:#6366f1;text-transform:uppercase;margin-bottom:6px;">TL;DR</div> <div style="font-size:0.95rem;line-height:1.6;"><ul> <li><code>testuser</code> compare all'01:14, tenta l'escalation, poi viene cancellato alle 04:47</li> <li><code>auth.log</code> registra ogni evento: creazione, tre sudo falliti, disconnessione</li> <li><code>find / -uid 1001 2&gt;/dev/null</code> trova i file rimasti anche dopo <code>userdel</code></li> <li>Cancellare un utente non cancella la sua storia - cancella solo il nome</li> </ul> </div> </div> <details style="border-left:3px solid #10b981;background:rgba(16,185,129,0.06);border-radius:0 6px 6px 0;margin:1.5rem 0;"> <summary style="padding:10px 16px;font-size:0.7rem;font-weight:800;letter-spacing:0.1em;color:#10b981;text-transform:uppercase;cursor:pointer;list-style:none;display:flex;align-items:center;gap:8px;"> <span style="font-size:0.65rem;transition:transform 0.2s;">▶</span> $ history </summary> <div style="padding:4px 16px 12px;font-size:0.92rem;line-height:1.7;font-family:'JetBrains Mono','Fira Code',monospace;"><ul> <li><a href="https://u-random.dev/comandi/grep/" >grep</a> -E &quot;useradd|userdel&quot; /var/log/auth.log</li> <li><a href="https://u-random.dev/comandi/grep/" >grep</a> &quot;testuser&quot; /var/log/auth.log</li> <li>last testuser</li> <li>find / -uid 1001 2&gt;/dev/null</li> <li>cat /home/testuser/.bash_history</li> <li>journalctl --since &quot;2026-03-25 04:40&quot;</li> </ul> </div> </details> <p><figure><img class="my-0 rounded-md" loading="lazy" decoding="async" fetchpriority="auto" alt="Utente cancellato - post-mortem auth.log" width="2752" height="1536" src="https://u-random.dev/assets/utente-cancellato-non-abbastanza_hu_eda3d265251eef1c.webp" srcset="https://u-random.dev/assets/utente-cancellato-non-abbastanza_hu_eda3d265251eef1c.webp 800w, https://u-random.dev/assets/utente-cancellato-non-abbastanza_hu_33e95f69c2ad1a10.webp 1280w" sizes="(min-width: 768px) 50vw, 65vw" data-zoom-src="https://u-random.dev/assets/utente-cancellato-non-abbastanza.webp"></figure> </p>