Hey folks,
I ran into something odd while using Live Terminal on one of my Mac devices, and I’m hoping someone can clear this up.
So, after running a session, I noticed a new local account popped up — something like Hexnode-RMM-
- Exists in the system directory with its own UID and home folder.
- Shows up in the /etc/sudoers file with full passwordless sudo access.
The bit that threw me off is even after I closed the Live Terminal session, the user stayed on the device with admin privileges intact. Our compliance scan actually flagged it as a potential security risk.
Is this normal behavior?
Shouldn’t this user be cleaned up automatically once the session ends, or are we supposed to handle that manually?
Just want to be sure I’m not missing something here, especially with that unrestricted sudo access sticking around.
13 Views
