[plug] auth.log

[Arie Hol]

On 16 Jul 2006 at 20:27, Daniel Pearson (Flashware Solutions) wrote:

> Just having a trawl through the logs on my Samba server (running on 
> Ubuntu server 6.06), and I've noticed the following *every* day at the
> exact same time: Jul 13 06:25:01 fs01 su[5018]: + ??? root:nobody Jul 
13

Do you have something in /etc/crontabs that could be spawning processes 
that try to "su to nobody" ?

Do you have a "nobody" account in /etc/passwd ? if so try disabling it 
and see what happens.

Regards Arie
------------------------------------------------------------------
 For the concert of life, nobody has a program.
------------------------------------------------------------------