/usr/bin/updatedb; Re: [plug] auth.log

[Alastair Irvine]

On Mon, 17 Jul 2006 11:33 am, Timothy White wrote:
> > > And here's everything that's in the Crontab atm..
> > > 17 *    * * *   root    run-parts --report /etc/cron.hourly
> > > 25 6    * * *   root    test -x /usr/sbin/anacron ||
> > > run-parts --report
> >
> > Am I right in suggesting that the line above is set to activate
> > at the same time that you are having the log entries for the
> > 'nobody' sessions ?
>
> Check the /etc/anacrontab and see what is running. You'll
> probably find that it's something in the /etc/cron.d or
> /etc/cron.daily directorys. (They are like 'crontab' parts,
> making up a large crontab, so not everything run by cron is in
> /etc/crontab, lots is in separate files, for easier management by
> packages).

As you can see from the above crontab lines, even if anacron is not 
installed, the files in /etc/cron.daily are still run.  As they are 
on my debian box.

I found out that /etc/cron.daily/find runs the /usr/bin/updatedb 
script*.  The former exports LOCALUSER="nobody", which tells the 
latter which user to "su" as.  This looks like the source of your 
log entries.

* this rebuilds a pathname database for use by the "locate" utility.

PS -- The "nobody" user is important for many programs (like Apache) 
that require it to exist so that they can run in "low priviledge" 
mode.  Don't remove it.