Strange message in /var/log/

Strange message in /var/log/

Post by Scalli » Tue, 09 Feb 1999 04:00:00



Hey,

When I looked in /var/log/messages, I found this line and it looked strange.
What does it mean? Could this be a security hazard? Thanx.

PAM_pwdb[831]: (su) session opened for user nobody
Feb  7 04:04:09  PAM_pwdb[831]: (su) session close

 
 
 

Strange message in /var/log/

Post by Rob Kom » Tue, 09 Feb 1999 04:00:00


: When I looked in /var/log/messages, I found this line and it looked strange.
: What does it mean? Could this be a security hazard? Thanx.
:
: PAM_pwdb[831]: (su) session opened for user nobody
: Feb  7 04:04:09  PAM_pwdb[831]: (su) session close

It's probably your `cron' daemon.  If you have a RedHat
system, then cron runs the update database command at
that time every night.  Look at /etc/crontab to see
what else is being run.

Cheers,
Rob Komar

 
 
 

Strange message in /var/log/

Post by jami » Tue, 09 Feb 1999 04:00:00



>Hey,

>When I looked in /var/log/messages, I found this line and it looked strange.
>What does it mean? Could this be a security hazard? Thanx.

>PAM_pwdb[831]: (su) session opened for user nobody
>Feb  7 04:04:09  PAM_pwdb[831]: (su) session close

The time is a clue.

cat /var/spool/cron/crontabs/nobody
# This updates the database for 'locate' every day:
40 04 * * *       updatedb 1> /dev/null 2> /dev/null

--

                "There's a seeker born every minute."

 
 
 

Strange message in /var/log/

Post by Gregory G. Woodbu » Wed, 10 Feb 1999 04:00:00




>: When I looked in /var/log/messages, I found this line and it looked strange.
>: What does it mean? Could this be a security hazard? Thanx.
>:
>: PAM_pwdb[831]: (su) session opened for user nobody
>: Feb  7 04:04:09  PAM_pwdb[831]: (su) session close

>It's probably your `cron' daemon.  If you have a RedHat
>system, then cron runs the update database command at
>that time every night.  Look at /etc/crontab to see
>what else is being run.

  Also, look at the files in "/etc/cron.daily" "/etc/cron.weekly" and so
on to examine the various tasks that RHat have configured.

--
Gregory G. "Wolfe" Woodbury      `-_-'    Owner/Admin: wolves.durham.nc.us
ggw at wolves.durham.nc.us         U      Errant co-moderator of:
                                                  soc.religion.unitarian-univ
"The Line Eater is a boojum snark."     Hug your wolf.  (Thanks Peter.)