[plug] auth.log

[Daniel Pearson]

root at fs01:/var/log/samba# cat /etc/passwd |grep nobody
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

And here's everything that's in the Crontab atm..
17 *    * * *   root    run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.daily
47 6    * * 7   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.weekly
52 6    1 * *   root    test -x /usr/sbin/anacron || run-parts --report 
/etc/cron.monthly

Cheers
*Daniel Pearson
*Flashware Solutions ABN 58 438 456 919
Mob: 0438 118 897  |  Email: daniel at flashware.net 
<mailto:daniel at flashware.net>

The information contained in this electronic transmission is 
confidential. If you are not the intended recipient of this 
transmission, use of this information is strictly prohibited.  If you 
have received this transmission in error, please contact Flashware 
Solutions 0438 118 897.


Arie Hol wrote:
> On 16 Jul 2006 at 20:27, Daniel Pearson (Flashware Solutions) wrote:
>
>   
>> Just having a trawl through the logs on my Samba server (running on 
>> Ubuntu server 6.06), and I've noticed the following *every* day at the
>> exact same time: Jul 13 06:25:01 fs01 su[5018]: + ??? root:nobody Jul 
>>     
> 13
>
> Do you have something in /etc/crontabs that could be spawning processes 
> that try to "su to nobody" ?
>
> Do you have a "nobody" account in /etc/passwd ? if so try disabling it 
> and see what happens.
>
> Regards Arie
> ------------------------------------------------------------------
>  For the concert of life, nobody has a program.
> ------------------------------------------------------------------
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.plug.org.au/pipermail/plug/attachments/20060716/8e086c65/attachment.html>