|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
I have noticed an entry in my log as follows...
Jan 15 00:15:18 bridget su: (to root) root on none
Jan 15 00:15:18 bridget PAM-unix2[13849]: session started for user root,
service su
Jan 15 00:16:34 bridget PAM-unix2[13849]: session finished for user root,
service su
These appear every day at exactly the same time. I have no crontab entry
for any jobs at this time. I checked back and it appears as far back as a
year ago, the last log I have. I ran 'chkrootkit' and it was clean. I
generally have the system pretty well locked up. Worrying about a possible
compromise. Any ideas?
Doug
****************************
* Doug Crompton *
* Richboro, PA 18954 *
* 215-431-6307 *
* *
* doug@crompton.com *
* wa3dsp@wa3dsp.ampr.org *
* http://www.crompton.com *
****************************
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|