Re: (FWD) rocky 06/14/01:07.02 system check
On Thu, Jun 14, 2001 at 07:51:16PM -0400, Paul M Foster wrote:
> Anyone have a clue what/why the following? I know logcheck is sending me
> this, but it looks weird.
> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Jun 14 06:26:01 rocky su[7575]: + ??? root-www-data
> Jun 14 06:26:01 rocky PAM_unix[7575]: (su) session opened for user www-data by (uid=0)
> Jun 14 06:26:02 rocky su[7594]: + ??? root-nobody
> Jun 14 06:26:02 rocky PAM_unix[7594]: (su) session opened for user nobody by (uid=0)
uid=0 means root -- so a root-owned process (maybe "apachectl
restart"?) did a setuid change, to user www-data.
that's the debian setup, which i hear is all the rage these
days. documentation and other-linux setups often tell apache to
operate as user "nobody".
odd that you'd have both, though. unless you changed your
settings and restarted apache all in one second. (pretty
impressive, if so.)
--
DEBIAN NEWBIE TIP #21 from Will Trillich <will@serensoft.com>
:
Looking to configure your Debian NETWORK SETTINGS? Look at the
file /etc/network/interfaces (try "man interfaces" for more
info). Then "ifup -a" to reload your settings, and "ifconfig" to
display them. (Also check out "apt-get install ipmasq"!)
Also see http://newbieDoc.sourceForge.net/ ...
Reply to: