<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1">root@fs01:/var/log/samba# cat /etc/passwd |grep nobody<br>
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh<br>
<br>
And here's everything that's in the Crontab atm..<br>
17 * * * * root run-parts --report /etc/cron.hourly<br>
25 6 * * * root test -x /usr/sbin/anacron || run-parts --report
/etc/cron.daily<br>
47 6 * * 7 root test -x /usr/sbin/anacron || run-parts --report
/etc/cron.weekly<br>
52 6 1 * * root test -x /usr/sbin/anacron || run-parts --report
/etc/cron.monthly<br>
<br>
Cheers<br>
</font>
<div class="moz-signature">
<meta http-equiv="Content-Type" content="text/html; ">
<div> <font face="Arial" size="2"><strong>Daniel Pearson<br>
</strong><font size="1">Flashware Solutions ABN 58 438 456 919</font></font></div>
<div> <font face="Arial"><font size="1">Mob: 0438 118 897 | Email: </font>
<a href="mailto:daniel@flashware.net"><font size="1">daniel@flashware.net</font></a></font></div>
<div> <font face="Arial" size="1"><br>
The information contained in this electronic transmission is
confidential. If you are not the intended recipient of this
transmission, use of this information is strictly prohibited. If you
have received this transmission in error, please contact Flashware
Solutions 0438 118 897.</font></div>
</div>
<br>
<br>
Arie Hol wrote:
<blockquote cite="mid44BAA53B.1511.21DF185@localhost" type="cite">
<pre wrap="">On 16 Jul 2006 at 20:27, Daniel Pearson (Flashware Solutions) wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Just having a trawl through the logs on my Samba server (running on
Ubuntu server 6.06), and I've noticed the following *every* day at the
exact same time: Jul 13 06:25:01 fs01 su[5018]: + ??? root:nobody Jul
</pre>
</blockquote>
<pre wrap=""><!---->13
Do you have something in /etc/crontabs that could be spawning processes
that try to "su to nobody" ?
Do you have a "nobody" account in /etc/passwd ? if so try disabling it
and see what happens.
Regards Arie
------------------------------------------------------------------
For the concert of life, nobody has a program.
------------------------------------------------------------------
_______________________________________________
PLUG discussion list: <a class="moz-txt-link-abbreviated" href="mailto:plug@plug.org.au">plug@plug.org.au</a>
<a class="moz-txt-link-freetext" href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</a>
Committee e-mail: <a class="moz-txt-link-abbreviated" href="mailto:committee@plug.linux.org.au">committee@plug.linux.org.au</a>
</pre>
</blockquote>
</body>
</html>