On 2002-04-05 11:21:39, Kirill Zverev wrote: > Apr 4 06:25:01 cmss su[30315]: + ??? root-nobody > Apr 4 06:25:01 cmss PAM_unix[30315]: (su) session opened for user nobody by > (uid=0) > > who could use su at six o'clock in the morning?
cron, possibly /etc/cron.daily/find: [EMAIL PROTECTED]:/etc$ grep 25 crontab 25 6 * * * root test -e /usr/sbin/anacron || run-parts --report /etc/cron.daily [EMAIL PROTECTED]:/etc/cron.daily$ grep nobody * find:cd / && updatedb --localuser=nobody 2>/dev/null /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA
pgpgbkWA8KJgn.pgp
Description: PGP signature
