Re: auth.log
Oki DZ <okidz@pindad.com> writes:
> Hi,
>
> I have quite many of the following lines in auth.log.
> bdg:/var/log# tail auth.log
> May 22 12:55:02 bdg PAM_unix[1477]: (cron) session closed for user root
> May 22 12:55:02 bdg PAM_unix[1476]: (cron) session closed for user root
> May 22 13:00:01 bdg PAM_unix[1536]: (cron) session opened for user
> root by (uid=0)
> May 22 13:00:02 bdg PAM_unix[1536]: (cron) session closed for user root
> May 22 13:05:01 bdg PAM_unix[1597]: (cron) session opened for user
> root by (uid=0)
> May 22 13:05:01 bdg PAM_unix[1596]: (cron) session opened for user
> root by (uid=0)
> May 22 13:05:01 bdg PAM_unix[1597]: (cron) session closed for user root
> May 22 13:05:02 bdg PAM_unix[1596]: (cron) session closed for user root
> May 22 13:10:01 bdg PAM_unix[1633]: (cron) session opened for user
> root by (uid=0)
> May 22 13:10:01 bdg PAM_unix[1633]: (cron) session closed for user root
>
> Does it mean that somebody has been trying to log in?
Looks like you have a cron job running every five minutes. As I don't
recall anything out of the box that does this, it's probably something
you configured yourself. I'd guess a mail-transfer-agent.
Check /etc/crontab and /etc/cron.d/* for culprits.
--
Olaf Meeuwissen Epson Kowa Corporation, CID
GnuPG key: 6BE37D90/AB6B 0D1F 99E7 1BF5 EB97 976A 16C7 F27D 6BE3 7D90
LPIC-2 -- I hack, therefore I am -- BOFH
--
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to:
- References:
- auth.log
- From: Oki DZ <okidz@pindad.com>