Re: [Q] intrusion

[Petr Cech <cech@atrey.karlin.mff.cuni.cz>]

On Thu, Jun 15, 2000 at 11:00:12AM -0500 , pvlad@bigfoot.com wrote:
> Hello,
> I found on my machine the following message one morning:
> 
> PAM_UNIX[763]: (su) session opened for user www-data by (uid=0)
> su [821]: + ??? root-nobody
> 
> PAM_UNIX[821]: (su) session opened for user nobody by (uid=0)

I'd say, it's the daily cron job. nobody is for find and www-data for some
apache stuff or dwww.

				Petr Cech
-- 
Debian GNU/Linux maintainer - www.debian.{org,cz}
           cech@atrey.karlin.mff.cuni.cz

<_Anarchy_> telsa: rommable debian will be potato chips