pam_unix filling up auth.log

Shwick · 10-02-2008, 11:25 PM

Running ubuntu 8.04 desktop.

I have sshd server running and there's a cron job that seems to be running every 10 seconds. It keeps opening and closing a session and it logs this every time to /var/log/auth.log.

Oct 2 14:45:01 desktop CRON[7760]: pam_unix(cron:session): session closed for user root
Oct 2 14:55:01 desktop CRON[7762]: pam_unix(cron:session): session opened for user root by (uid=0)
Oct 2 14:55:01 desktop CRON[7762]: pam_unix(cron:session): session closed for user root
Oct 2 15:05:01 desktop CRON[7764]: pam_unix(cron:session): session opened for user root by (uid=0)

Is there an elegant way to stop this, I don't think this is supposed to happen.

chrism01 · 10-02-2008, 11:35 PM

Looks more like every 10 mins to me. Check your crontabs. 1 Minute is the smallest time you can specify in cron.
In addition, there should be a cron job that rotates your logs regularly, so disc space shouldn't be an issue.

Shwick · 10-04-2008, 11:44 AM

I've read how pam can block brute force ssh attacks but I already have an iptables configuration doing that.

I don't really know what it's doing logging into ssh as root every 10 minutes, and I don't think I need it doing that either.

I tried Try sudo crontab -l and it comes up blank.

Shwick · 10-07-2008, 09:37 PM

Anyone encounter this problem before?

chrism01 · 10-07-2008, 09:48 PM

login as root, cd /etc and do

ls -l |grep cron

you'll get something like

Code:

-rw-r--r--  1 root root     321 2007-12-11 18:41 anacrontab
drwxr-xr-x  2 root root    4096 2008-02-13 17:24 cron.d
drwxr-xr-x  2 root root    4096 2008-09-03 18:53 cron.daily
-rw-r--r--  1 root root       0 2008-02-13 17:24 cron.deny
drwxr-xr-x  2 root root    4096 2007-09-25 18:38 cron.hourly
drwxr-xr-x  2 root root    4096 2008-07-23 21:25 cron.monthly
drwxr-xr-x  2 root root    4096 2008-07-23 21:25 cron.weekly
-rw-r--r--  1 root root     255 2007-09-25 18:38 crontab

you need to check all those files/dirs. Something is running and you need to know what.
Also, you can predict from that log you've shown when its going to run, so run

top

in an xterm and keep an eye out when you expect it.

Shwick · 10-08-2008, 08:38 PM

Finally. Stupid sysstat, some package that supplies mpstat, iostat and sar commands.

It had a script in /etc/cron.d/sysstat which sent machine statistics every 10 minutes to an ubuntu central server where they analyzed the information to gear the next release to the most common machine hardware against your will!!!!

No wait... just the first part about it logging stats to a file every 10 minutes.