mysterious "message bus" user account

Question

mysterious "message bus" user account

list,

an account named "message bus" appears in my accounts preference pane. i did not add this account. it is a standard account.

any insights? where did it come from? is it safe to delete?

thanks
eric

macbook pro Mac OS X (10.4.9)

Posted on Apr 27, 2007 7:20 AM

Reply

Answer 1

Apr 27, 2007 1:51 PM in response to Eric Connally

I can find nothing that refers to that account as legitimate. It should be safe to delete.
But, before you do, you might want to open Terminal and type "last" to see if that account has ever logged on to the system. Also look in your system logs to see if you can find out when that account was created (The creation date on the user's home folder may help as well, if there is one); do some detective work and find the culprit behind the account.

Reply

Answer 2

Apr 27, 2007 4:06 PM in response to Eric Connally

Eric

As well as Joe's suggestions, copy and paste the following into the Terminal window followed by a return:

nireport . /users uid gid name realname home | grep "message bus"

Copy and paste the result from the Terminal window to a post here.

Also, does this account have a Home folder visible in Finder?

Reply

Answer 3

Apr 27, 2007 4:33 PM in response to Michael Conniff

michael, joe,

thanks for your responses.

after my original post, i decided to backup my hard drive (superduper! to an external firewire) then delete the account. this seemed to go fine. after joe's post i booted off the firewire to look around. user 'messagebus' had never logged in; nor could i find any creation date in the syslogs etc.

there is no visible home folder. i (perhaps foolishly) decided to log in as messagebus to see if that helped me figure anything out; after resetting the password i did so, and at login got a message about the home folder not being found.

then i got your message michael, and here is the output:

19:27 ~ % nireport . /users uid gid name realname home | grep "messagebus"
506 506 messagebus Message Bus /dev/null

i'm inclined to mark this question as "answered" since deleting the account has caused no obvious harm. but i am curious where on earth it came from. i do try to practice reasonable hygiene.

thanks again for the help

eric

Reply

Answer 4

Apr 28, 2007 4:27 AM in response to Eric Connally

Eric

506 506 messagebus Message Bus /dev/null

Well the UID being greater than 500 explains why it appears as a login option, and is not a "system" type account. But the "/dev/null" as Home directory is more usual on system accounts (although "/var/empty" seems to be preferred nowadays).

i am curious where on earth it came from

So am I! 🙂 Do let us know if you find out!

Reply

Answer 5

Apr 28, 2007 4:32 AM in response to Michael Conniff

will do. i keep checking the accounts pane to see if it has reappeared. the weird thing is i have it locked ("Click the lock to make changes.") so maybe i'll change my password as well.

thanks again
eric

Reply

Answer 6

Apr 30, 2007 1:44 AM in response to Eric Connally

will do. i keep checking the accounts pane to see if
it has reappeared. the weird thing is i have it
locked ("Click the lock to make changes.") so maybe
i'll change my password as well.

thanks again
eric

Well.. I may be wrong, but I vaguely remeber something alike on linux. It could be an interprocess communication feature.
Have you played around with Fink or some linux-like program, recently?

Ciao,
Ermanno

Reply

Answer 7

Apr 30, 2007 3:45 AM in response to Ermanno Polli

not fink, but i do use darwinports (or macports now)... however nothing recent comes to mind, aside from installing TeXLive ...

Reply

Answer 8

Apr 30, 2007 4:04 AM in response to Eric Connally

not fink, but i do use darwinports (or macports
now)... however nothing recent comes to mind, aside
from installing TeXLive ...

In the meantime I've Googled a bit and I found:

http://www.mbus.org/

It's official: RFC 3259.

Did TeXLive come in a binary pre-compiled package or in source package?
In the second case you may search the package for Mbus.
Just for your curiosity...
It's now obvious that Mbus was installed, and the account created, by some software that had it in its pre-requisites.

Ciao,
Ermanno

Reply

Answer 9

Apr 30, 2007 4:16 AM in response to Ermanno Polli

interesting...

i believe the TeX distribution came as an installer (a mpkg) which i'm not sure how to search (also i don't appear to have kept the installer pkg)

Reply

Answer 10

Apr 30, 2007 6:17 AM in response to Eric Connally

interesting...

i believe the TeX distribution came as an installer
(a mpkg) which i'm not sure how to search (also i
don't appear to have kept the installer pkg)

Ahhh.. too bad..
You could have been able to poke around with Pacifist (search in www.versiontracker.com) to look what's inside the package.

Ciao,
Ermanno

Reply

Answer 11

Apr 30, 2007 7:00 AM in response to Ermanno Polli

out of curiosity i re-downloaded the TeX installer and searched it using pacifist (which is a nifty app). but i saw nothing along the lines of mbus, messagebus, or other variations i could think of.

thanks for the tip all the same
eric

Reply

Answer 12

May 11, 2007 4:00 PM in response to Eric Connally

Hi,

an account named "message bus" appears in my accounts
preference pane. i did not add this account. it is a
standard account.

any insights? where did it come from? is it safe to
delete?

I suspect it was installed with the dbus package, itself no doubt a dependency installed by macports.

I'm very new to MacOS, and hadn't seen *BSD in the flesh before, so this is a bit hand-wavy. I infer that BSD packages (as installed by macports) are described by a "portfile", which seems to include installation and compilation directives. I found the following:

http://dbus.darwinports.com/dports/devel/dbus/Portfile

which seems to be the portfile for dbus. Within it you'll find

pre-activate {
addgroup messagebus
adduser messagebus gid=[existsgroup messagebus] realname=Message\ Bus
}

This seems like a give-away.

Anyway, I too have discovered this user (which is how I found this post), but I guess you need to leave it be. What's still bugging me is that it has interfered with my fast user switching...

R

Reply

Answer 13

May 11, 2007 5:20 PM in response to r.stiltskin

thanks for the heads-up. i think you have figured it out. FWIW i deleted the account awhile ago with no evident ill-effects, though i don't think i've used macports for any installs/upgrades recently, so who knows, maybe it will croak when i do.

Reply