Doug Crompton on 15 Jan 2005 08:22:30 -0000


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[PLUG] what is this?


I have noticed an entry in my log as follows...

Jan 15 00:15:18 bridget su: (to root) root on none
Jan 15 00:15:18 bridget PAM-unix2[13849]: session started for user root,
service su
Jan 15 00:16:34 bridget PAM-unix2[13849]: session finished for user root,
service su

These appear every day at exactly the same time. I have no crontab entry
for any jobs at this time. I checked back and it appears as far back as a
year ago, the last log I have. I ran 'chkrootkit' and it was clean. I
generally have the system pretty well locked up. Worrying about a possible
compromise. Any ideas?

Doug

****************************
*  Doug Crompton	   *
*  Richboro, PA 18954	   *
*  215-431-6307		   *
*		  	   *
* doug@crompton.com        *
* wa3dsp@wa3dsp.ampr.org   *
* http://www.crompton.com  *
****************************


___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug