OK, I was checking my firewall logs to make sure no intruders were getting in, i was looking and looling, a couple of pings that were not responded to. THEN I see this message:

PAM_unix[3114]: (system-auth) session opened for user news by (uid=0)
PAM_unix[3114]: (system-auth) session closed for user news

I don't go to user news groups or have news enabled. Is this something I need to be concerned about?

Maybe.

If you don't log in as "news" and didn't even know you had a "news" user then I would say unplug your box, and reinstall. It seems that whoever it was has root on your box. When it says session was open by uid=0 that means either the root user or another user with root privileges is on your box. Too bad the message wasn't more descriptive.

Most likely it didn't authenticate and failed. /var/log/messages will always record like that above, usually making it seem as if someone might have accessed your system, but really didn't. You'll want to check any of your other logs and see if anything matches something similiar to the user news.. etc.. to make for sure they didn't get access. But it doesn't hurt to unplug your machine while checking it out.

For example though, my FTP server doesn't allow anonymous connections.. but the messages file will only indicate this:

Jul 2 04:28:47 blackhole proftpd[25825] : connect from 210.0.186.132

Making it seem as if someone actually connected, but when I look at the ftp log, it closed their session as they couldn't login with correct name and password. Hope this eases your mind a bit. But definitely still look into it though.

If available, you might try running the commands last and lastb. last will show successful logins while lastb will show unsuccessful login attempts. Hope this helps resolve your question. -mk

Don't worry. It's just a cron job doing what it's supposed to.
/etc/cron.daily/slrnpull-expire I would suspect.

---------------------------------------------
The slrn-pull package provides the slrnpull utility, which allows you to set up a small news spool for offline news reading using the SLRN news reader. You also need to have the slrn package installed to use the slrnpull utility.

Thanks Leffe, It was the cron, I didn't get hacked in. Thanks again, I'm glad it was the cron job.