Re: auth.log

[Olaf Meeuwissen <olaf@epkowa.co.jp>]

Oki DZ <okidz@pindad.com> writes:

> Hi,
> 
> I have quite many of the following lines in auth.log.
> bdg:/var/log# tail auth.log
> May 22 12:55:02 bdg PAM_unix[1477]: (cron) session closed for user root
> May 22 12:55:02 bdg PAM_unix[1476]: (cron) session closed for user root
> May 22 13:00:01 bdg PAM_unix[1536]: (cron) session opened for user
> root by (uid=0)
> May 22 13:00:02 bdg PAM_unix[1536]: (cron) session closed for user root
> May 22 13:05:01 bdg PAM_unix[1597]: (cron) session opened for user
> root by (uid=0)
> May 22 13:05:01 bdg PAM_unix[1596]: (cron) session opened for user
> root by (uid=0)
> May 22 13:05:01 bdg PAM_unix[1597]: (cron) session closed for user root
> May 22 13:05:02 bdg PAM_unix[1596]: (cron) session closed for user root
> May 22 13:10:01 bdg PAM_unix[1633]: (cron) session opened for user
> root by (uid=0)
> May 22 13:10:01 bdg PAM_unix[1633]: (cron) session closed for user root
> 
> Does it mean that somebody has been trying to log in?

Looks like you have a cron job running every five minutes.  As I don't
recall anything out of the box that does this, it's probably something
you configured yourself.  I'd guess a mail-transfer-agent.

Check /etc/crontab and /etc/cron.d/* for culprits.
-- 
Olaf Meeuwissen                            Epson Kowa Corporation, CID
GnuPG key: 6BE37D90/AB6B 0D1F 99E7 1BF5 EB97  976A 16C7 F27D 6BE3 7D90
LPIC-2               -- I hack, therefore I am --                 BOFH


-- 
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org