On 2002-04-05 11:21:39, Kirill Zverev wrote: > Apr 4 06:25:01 cmss su[30315]: + ??? root-nobody > Apr 4 06:25:01 cmss PAM_unix[30315]: (su) session opened for user nobody by (uid=0) > > who could use su at six o'clock in the morning? cron, possibly /etc/cron.daily/find: awind@pawan:/etc$ grep 25 crontab 25 6 * * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.daily awind@pawan:/etc/cron.daily$ grep nobody * find:cd / && updatedb --localuser=nobody 2>/dev/null /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA
Attachment:
pgpiqg2gsw7kU.pgp
Description: PGP signature