OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	12/10/2025 03:41:29 PM	r-xr-xr-x
📁 boot	-	12/17/2024 04:00:59 AM	rwxr-xr-x
📁 catalog	-	02/08/2025 12:06:49 AM	rwxr-xr-x
📄 libsystemd-shared-239.so	2.63 MB	12/17/2024 04:01:11 AM	rwxr-xr-x
📁 network	-	02/08/2025 12:06:53 AM	rwxr-xr-x
📁 ntp-units.d	-	03/16/2023 11:26:18 AM	rwxr-xr-x
📁 portable	-	12/17/2024 04:00:59 AM	rwxr-xr-x
📄 portablectl	37 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 purge-nobody-user	2.3 KB	12/17/2024 04:01:00 AM	rwxr-xr-x
📄 resolv.conf	678 bytes	06/22/2018 11:11:49 AM	rw-r--r--
📁 system	-	01/14/2026 08:10:52 AM	rwxr-xr-x
📁 system-generators	-	02/08/2025 12:06:53 AM	rwxr-xr-x
📁 system-preset	-	12/10/2025 03:41:29 PM	rwxr-xr-x
📁 system-shutdown	-	12/17/2024 04:01:00 AM	rwxr-xr-x
📁 system-sleep	-	12/17/2024 04:01:00 AM	rwxr-xr-x
📄 systemd	1.53 MB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-ac-power	11.87 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-backlight	24.74 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-binfmt	16.69 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-cgroups-agent	12.01 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-coredump	61.17 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-cryptsetup	28.74 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-dissect	16.02 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-export	41.18 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-fsck	24.73 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-growfs	20.43 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-hibernate-resume	12.01 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-hostnamed	28.91 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-initctl	20.44 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-journald	154.41 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-localed	49.18 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-logind	265.3 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-makefs	12.41 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-modules-load	20.42 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-portabled	89.9 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-pstore	20.88 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-quotacheck	12.29 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-random-seed	16.01 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-remount-fs	24.54 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-reply-password	12 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-resolved	452.75 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-rfkill	24.74 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-shutdown	61.2 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-sleep	20.77 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-socket-proxyd	24.55 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-sulogin-shell	16.02 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-sysctl	20.77 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-sysv-install	0 bytes	01/01/1970 12:00:00 AM	---------
📄 systemd-timedated	36.95 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-udevd	408.55 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-update-done	12.42 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-update-utmp	16.02 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-user-runtime-dir	245.13 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-user-sessions	11.86 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-vconsole-setup	20.46 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-veritysetup	12.01 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📄 systemd-volatile-root	12.01 KB	12/17/2024 04:01:11 AM	rwxr-xr-x
📁 user	-	02/08/2025 12:06:56 AM	rwxr-xr-x
📁 user-environment-generators	-	02/08/2025 12:06:51 AM	rwxr-xr-x
📁 user-generators	-	12/17/2024 04:01:00 AM	rwxr-xr-x
📁 user-preset	-	02/08/2025 12:06:51 AM	rwxr-xr-x

Name

Size

Modified

Perms

📁 ..

12/10/2025 03:41:29 PM

r-xr-xr-x

📁 boot

12/17/2024 04:00:59 AM

rwxr-xr-x

📁 catalog

02/08/2025 12:06:49 AM

rwxr-xr-x

📄 libsystemd-shared-239.so

2.63 MB

12/17/2024 04:01:11 AM

rwxr-xr-x

📁 network

02/08/2025 12:06:53 AM

rwxr-xr-x

📁 ntp-units.d

03/16/2023 11:26:18 AM

rwxr-xr-x

📁 portable

12/17/2024 04:00:59 AM

rwxr-xr-x

📄 portablectl

37 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 purge-nobody-user

2.3 KB

12/17/2024 04:01:00 AM

rwxr-xr-x

📄 resolv.conf

678 bytes

06/22/2018 11:11:49 AM

rw-r--r--

📁 system

01/14/2026 08:10:52 AM

rwxr-xr-x

📁 system-generators

02/08/2025 12:06:53 AM

rwxr-xr-x

📁 system-preset

12/10/2025 03:41:29 PM

rwxr-xr-x

📁 system-shutdown

12/17/2024 04:01:00 AM

rwxr-xr-x

📁 system-sleep

12/17/2024 04:01:00 AM

rwxr-xr-x

📄 systemd

1.53 MB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-ac-power

11.87 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-backlight

24.74 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-binfmt

16.69 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-cgroups-agent

12.01 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-coredump

61.17 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-cryptsetup

28.74 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-dissect

16.02 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-export

41.18 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-fsck

24.73 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-growfs

20.43 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-hibernate-resume

12.01 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-hostnamed

28.91 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-initctl

20.44 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-journald

154.41 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-localed

49.18 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-logind

265.3 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-makefs

12.41 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-modules-load

20.42 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-portabled

89.9 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-pstore

20.88 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-quotacheck

12.29 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-random-seed

16.01 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-remount-fs

24.54 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-reply-password

12 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-resolved

452.75 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-rfkill

24.74 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-shutdown

61.2 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-sleep

20.77 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-socket-proxyd

24.55 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-sulogin-shell

16.02 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-sysctl

20.77 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-sysv-install

0 bytes

01/01/1970 12:00:00 AM

---------

📄 systemd-timedated

36.95 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-udevd

408.55 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-update-done

12.42 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-update-utmp

16.02 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-user-runtime-dir

245.13 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-user-sessions

11.86 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-vconsole-setup

20.46 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-veritysetup

12.01 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📄 systemd-volatile-root

12.01 KB

12/17/2024 04:01:11 AM

rwxr-xr-x

📁 user

02/08/2025 12:06:56 AM

rwxr-xr-x

📁 user-environment-generators

02/08/2025 12:06:51 AM

rwxr-xr-x

📁 user-generators

12/17/2024 04:01:00 AM

rwxr-xr-x

📁 user-preset

02/08/2025 12:06:51 AM

rwxr-xr-x

Editing: purge-nobody-user

#!/bin/bash -eu

if [ $UID -ne 0 ]; then
    echo "WARNING: This script needs to run as root to be effective"
    exit 1
fi

export SYSTEMD_NSS_BYPASS_SYNTHETIC=1

if [ "${1:-}" = "--ignore-journal" ]; then
    shift
    ignore_journal=1
else
    ignore_journal=0
fi

echo "Checking processes..."
if ps h -u 99 | grep .; then
    echo "ERROR: ps reports processes with UID 99!"
    exit 2
fi
echo "... not found"

echo "Checking UTMP..."
if w -h 199 | grep . ; then
    echo "ERROR: w reports UID 99 as active!"
    exit 2
fi
if w -h nobody | grep . ; then
    echo "ERROR: w reports user nobody as active!"
    exit 2
fi
echo "... not found"

echo "Checking the journal..."
if [ "$ignore_journal" = 0 ] && journalctl -q -b -n10 _UID=99 | grep . ; then
    echo "ERROR: journalctl reports messages from UID 99 in current boot!"
    exit 2
fi
echo "... not found"

echo "Looking for files in /etc, /run, /tmp, and /var..."
if find /etc /run /tmp /var -uid 99 -print | grep -m 10 . ; then
    echo "ERROR: found files belonging to UID 99"
    exit 2
fi
echo "... not found"

echo "Checking if nobody is defined correctly..."
if getent passwd nobody |
	grep '^nobody:[x*]:65534:65534:.*:/:/sbin/nologin';
then
    echo "OK, nothing to do."
    exit 0
else
    echo "NOTICE: User nobody is not defined correctly"
fi

echo "Checking if nfsnobody or something else is using the uid..."
if getent passwd 65534 | grep . ; then
    echo "NOTICE: will have to remove this user"
else
    echo "... not found"
fi

if [ "${1:-}" = "-x" ]; then
    if getent passwd nobody >/dev/null; then
	# this will remove both the user and the group.
	( set -x
   	  userdel nobody
	)
    fi

if getent passwd 65534 >/dev/null; then
	# Make sure the uid is unused. This should free gid too.
	name="$(getent passwd 65534 | cut -d: -f1)"
	( set -x
	  userdel "$name"
	)
    fi

if grep -qE '^(passwd|group):.*\bsss\b' /etc/nsswitch.conf; then
	echo "Sleeping, so sss can catch up"
	sleep 3
    fi

if getent group 65534; then
	# Make sure the gid is unused, even if uid wasn't.
	name="$(getent group 65534 | cut -d: -f1)"
	( set -x
	  groupdel "$name"
	)
    fi

# systemd-sysusers uses the same gid and uid
    ( set -x
      systemd-sysusers --inline 'u nobody 65534 "Kernel Overflow User" / /sbin/nologin'
    )
else
    echo "Pass '-x' to perform changes"
fi