An account that appeared at 3 a.m.
A new account with sudo rights showed up on db-01 overnight. Use auth.log and /etc/group to work out which account created it, from where, and what rights it got.
Briefing
The weekly account review found svc-backup on db-01. No ticket mentions it, and the backup team says they do not use local accounts.
useradd, usermod, and passwd all write to /var/log/auth.log, and so does the sudo call that ran them.
db-01 · Linux log triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.