We have a user called mysql on our Solaris11 server. We don't user MySQL. It was not there last year. Is there a way to find out how it got created and when it was created?
Last year was a long time ago. Is there anything in the user's home directory, on the server, any auditing or anything to suggest anything bad happened?
This user's home directory as per the /etc/passwd is /.
So, I can't check when it was created.
This account is a default reserved one present in a default Solaris 11 installation so I doubt it wasn't already there last year.
In any case, if your /etc/passwd file lists:
mysql:x:70:70:MySQL Reserved UID:/:
there is nothing to worry about.