session opened for user nobody

r.stiltskin · 03-13-2006, 10:26 AM

Code:

su[3402]: + ??? root:nobody
su[3402]: (pam_unix) session opened for user nobody by (uid=0)

I understand that this is a normal daily cron event, but I'd like a fuller understanding of what it is doing. Where can I find a full explanation?

dracae · 03-13-2006, 11:37 AM

You have a cron job that is dropping privs to that of nobody. PAM is logging it.
look in /etc/cron* to find out what script is actually being run

r.stiltskin · 03-13-2006, 12:47 PM

I can't tell anything by looking at those directories. This "nobody" entry occurs every day at 6:25 AM. Maybe it's just the daily rotating of the log files. Here's what I see in /etc/cron.daily:

Code:

bsdmainutils  find       man-db    netkit-inetd  standard
exim4-base    logrotate  modutils  quota         sysklogd

But what I really want to understand is the idea of the user "nobody". Why is there a "nobody"? Is that a user account for the cron daemon? for all daemons? and what's the meaning of the entry

Code:

+ ??? root:nobody

?

dracae · 03-13-2006, 01:06 PM

In Debian that username maps to userid 65534. There should be no files or directories owned by this user. This means that this user only has access to files and folders where world/other has access.
The purpose of this id is to drop all privileges

r.stiltskin · 03-13-2006, 01:17 PM

What does that mean: "drop all privileges"?

Where should I look to read about that?