some LDAP users was automaticaly removed

[bran.ko]

HI, last night I have strage behavior. Some users was removed - by script I think
only in configuration backup is logged

Code Select Expand

  <revision>
    <username>(root)</username>
    <description>The users "user1,...,user6(changed real name)" where successfully removed.</description>
    <time>1775862000.71</time>
  </revision>
This 6 users was LDAP users not local on firewall. But there are another 32 users without any problems.
I try to find some differencies but unsucessfully.

Which script is stared at 01:00 ? My cron is empty (thru web UI). User root is disabled for web logon.

[ahro_john]

HI, last night I have strage behavior. Some users was removed - by script I think
only in configuration backup is logged
CodeSelect
  <revision>
    <username>(root)</username>
    <description>The users "user1,...,user6(changed real name)" where successfully removed.</description>
    <time>1775862000.71</time>
  </revision>

This 6 users was LDAP users not local on firewall. But there are another 32 users without any problems.
I try to find some differencies but unsucessfully.

Which script is stared at 01:00 ? My cron is empty (thru web UI). User root is disabled for web logon. It feels like some kind of automated process or external sync triggered this — similar to how scheduled systems operate on online platforms (even outside networking), for example services like goranked.gg that rely on backend automation for account-related actions.

Have you checked /var/log/system.log or the audit logs around 01:00? Even if the GUI cron is empty, system-level cron or package tasks might still trigger something

[bran.ko]

/var/log/system/latest.log is clear only systemctl log is here with some activity, and acme logs

Code Select Expand

<13>1 2026-04-11T00:15:04+02:00 firewall configctl 63706 - [meta sequenceId="26"] event @ 1775859304.15 msg: Apr 11 00:15:04 firewall config[56811]: config-event: new_config /conf/backup/config-1775859304.1084.xml
<13>1 2026-04-11T00:15:04+02:00 firewall configctl 63706 - [meta sequenceId="28"] event @ 1775859304.15 exec: system event config_changed response: OK
/var/log/audit/latest - is clear also

crontab -e 
yes there is some scheduled scripts - byt nothing suspisious

firewall has installed all patches/updates

[franco]

Make sure to mention what version you're using.

We hotfixed 25.10.2 now due to the side effect from the security update:

https://github.com/opnsense/changelog/commit/055b8d6


Cheers,
Franco

[bran.ko]

HI, today was deleted one user (which was recovered). 
So I install new hotfix.We will see

[bran.ko]

it seems to be fixed. Any LDAP user wasn't automaticaly deleted.
Thanks

[franco]

Nice, thanks for the feedback!


Cheers,
Franco