I noticed user_added events while I was looking at the type of events that are logged. I am wondering under what condition these occur. The events are a split of a second apart. From a paranoid perspective these are users that are added by a hacker to perform some operations, but if someone were to obtain the cert to my ssh and private key password, then why use HA to perform operations?
I am currently assuming this is HA doing some background work, however I need to ensure the system is not compromised. Any ideas?
home-assistant=# select * from events where event_type like 'user_%'
home-assistant-# \g
event_id | event_type | event_data | origin | time_fired | created | context_id | context_user_id
----------+--------------+-------------------------------------------------+--------+-------------------------------+-------------------------------+----------------------------------+-----------------
774874 | user_added | {"user_id": "cfb62151c0eb4a7aa2b2b8727d4b728a"} | LOCAL | 2019-06-04 04:36:05.938884+00 | 2019-06-04 04:36:05.942436+00 | 3b0ae2773ffa4a699fc94c37527f718a |
774875 | user_removed | {"user_id": "cfb62151c0eb4a7aa2b2b8727d4b728a"} | LOCAL | 2019-06-04 04:36:05.977822+00 | 2019-06-04 04:36:05.981319+00 | e1df5cbb588d4ac6813a5c8218d03ef2 |
774885 | user_added | {"user_id": "5cc2f49336b54324a2c794de86a17591"} | LOCAL | 2019-06-04 04:37:06.85281+00 | 2019-06-04 04:37:06.859494+00 | 21cb504afce94c3a83c2314030040463 |
774886 | user_removed | {"user_id": "5cc2f49336b54324a2c794de86a17591"} | LOCAL | 2019-06-04 04:37:06.898512+00 | 2019-06-04 04:37:06.904854+00 | f56727bd7a26434d968d91b9a13e16e2 |
774890 | user_added | {"user_id": "8c9276f9c85947f7bf648eb6972c6235"} | LOCAL | 2019-06-04 04:37:10.452684+00 | 2019-06-04 04:37:10.479782+00 | c9381be071f0468b9f38cd48750be572 |
774891 | user_removed | {"user_id": "8c9276f9c85947f7bf648eb6972c6235"} | LOCAL | 2019-06-04 04:37:10.499403+00 | 2019-06-04 04:37:10.502882+00 | d3e0bef7d68c482eb211754521f6e394 |
(6 rows)