lot of entries in auth.log

raulfg3 · 6. Dezember 2014

is this normal ? :

Code

Nov 30 07:39:01 RNAS CRON[2463]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 07:39:01 RNAS CRON[2463]: pam_unix(cron:session): session closed for user root
Nov 30 07:45:01 RNAS CRON[3235]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 07:45:02 RNAS CRON[3235]: pam_unix(cron:session): session closed for user root
Nov 30 08:00:01 RNAS CRON[5157]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:00:03 RNAS CRON[5157]: pam_unix(cron:session): session closed for user root
Nov 30 08:09:01 RNAS CRON[6358]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:09:01 RNAS CRON[6358]: pam_unix(cron:session): session closed for user root
Nov 30 08:15:01 RNAS CRON[7090]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:15:02 RNAS CRON[7090]: pam_unix(cron:session): session closed for user root
Nov 30 08:17:01 RNAS CRON[7452]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:17:03 RNAS CRON[7452]: pam_unix(cron:session): session closed for user root
Nov 30 08:30:01 RNAS CRON[9066]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:30:02 RNAS CRON[9066]: pam_unix(cron:session): session closed for user root
Nov 30 08:39:01 RNAS CRON[10268]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:39:01 RNAS CRON[10268]: pam_unix(cron:session): session closed for user root
Nov 30 08:45:01 RNAS CRON[11117]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 08:45:03 RNAS CRON[11117]: pam_unix(cron:session): session closed for user root
Nov 30 09:00:01 RNAS CRON[13050]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:00:02 RNAS CRON[13050]: pam_unix(cron:session): session closed for user root
Nov 30 09:09:01 RNAS CRON[14257]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:09:01 RNAS CRON[14257]: pam_unix(cron:session): session closed for user root
Nov 30 09:15:01 RNAS CRON[14989]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:15:03 RNAS CRON[14989]: pam_unix(cron:session): session closed for user root
Nov 30 09:17:01 RNAS CRON[15350]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:17:02 RNAS CRON[15350]: pam_unix(cron:session): session closed for user root
Nov 30 09:30:01 RNAS CRON[16915]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:30:03 RNAS CRON[16915]: pam_unix(cron:session): session closed for user root
Nov 30 09:39:01 RNAS CRON[18116]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:39:01 RNAS CRON[18116]: pam_unix(cron:session): session closed for user root
Nov 30 09:45:01 RNAS CRON[18848]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 09:45:02 RNAS CRON[18848]: pam_unix(cron:session): session closed for user root
Nov 30 10:00:01 RNAS CRON[20769]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 10:00:03 RNAS CRON[20769]: pam_unix(cron:session): session closed for user root
Nov 30 10:09:01 RNAS CRON[21970]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 30 10:09:01 RNAS CRON[21970]: pam_unix(cron:session): session closed for user root
Nov 30 10:15:01 RNAS CRON[22702]: pam_unix(cron:session): session opened for user root by (uid=0)

Alles anzeigen

I do not know if this is normal or not or if is some tipe of atack to gain remote acess.

tekkb · 6. Dezember 2014

You can have less entries by not accessing OMV so much...

It is normal.

PS- If you want you can delete the old logs that end in .gz

raulfg3 · 6. Dezember 2014

but this entries are not mine, I only entry one time today and none yesterday, and as can you see are a lot of them.

and all at minute 01 -> this mean some type on cron job, but i have none cron jobs.

tekkb · 6. Dezember 2014

There are things running that use root. There are cron jobs setup by OMV and other things that you do not see.

The graphs are one.

/etc/cron.d/openmediavault-rrdtoolgraph (it is every 15 minutes usually a couple seconds past each 15 minute mark)

Jetzt mitmachen!