Hi all,

Using the new chrootkit reports that the nobody user is in one way or another tied into the crontab, which apparently some worm is known to attack.

I've seen some recommend creating a group for cron and assigning the users, then chmod the crontab binary to the new cron group. Other distror's have the cron.deny and cron.allow and we don't in slack 11.0 and suspect that might be a good thingie to have.

I did a find on my "/" for user nobody for files and a default noob install of slack 11 with huge 26 kernel yeilds 2 files in /sys that are owned by 'nobody' as well.

I'd like to know if I can remove nobody and put a different cron in my slack 11.0

I'm concerned about 'nobody' in my boxen as I see in past years that slackware (&other distro's) had security exploits running services, daemons as the nobody account.

Another reason I'm thinking of doing this is that I turn off my pc when not using it so cron doesnt run it jobs.

Has anyone had any experience removing 'nobody' and putting in a different cron scheduler? Will it break me? Any recommendations?

Thanks in advance.

Using the new chrootkit reports that the nobody user is in one way or another tied into the crontab, which apparently some worm is known to attack.
Lupper worm to be exactly which is a 2005-ish XML-RPC and Awstats thing so not some new outbreak AFAIK, see http://cve.mitre.org/cgi-bin/cvename...=CVE-2005-0116 and http://cve.mitre.org/cgi-bin/cvename...=CVE-2005-1921.


Other distro's have the cron.deny and cron.allow and we don't in slack 11.0
Because of defaulting to Dcron. Vixie should be available though.


I'd like to know if I can remove nobody
If listing nobody's crontab shows it's not used for doing system stuff and if /etc/groups show crontab group membership you could remove nobody from that group.

Thank you unspawn. I'm gonna give removing noboday a try and see what happens. I don't see the crontab showing any tasks, /etc/groups doesn't show nobody either. I do have those two files owned by 'nobody' and they change every boot. So I'm gonna image the pc and give it a shot.

I was wondering, do you have any experience with 'fcron' ? It appears from their site (i stumbled on it looking for vixie as I google'd) that they are actively developing it, and for a user like me, who shuts down every day it may keep those tasks of "updatedb" that slack11 schedules as default to run, and I can supposedly set a 'nice' level to it. That sounds pretty neat, but I didnt know if you had any experiences you might like to share at all

thanks again.

You don't have to "image" the machine, just tarball up the offending files.

No experience with Fcron here. A quick tour of the CVE could show another way of decising which crond to use: it shows dcron to have 0 vulns in 2006, fcron had 2 and vixie 1. Something *I* stumbled on while looking for more info was that Vixie appears to allow notations like "@reboot" and "@yearly". Useful.

As far as renicing jobs goes you could start your script with a renice line. I use Bash and a central source file which contains functions like:
So I'll just call "reniceSelf" from within the script or "reniceSelf -5" if the default isn't good enough.

You don't have to "image" the machine, just tarball up the offending files

I'm still so stuck in my windows ways, trying to break the habbits.

Thanks for the feedback on vixie, I'm going to give that a shot then, and the reniceself looks really promising too. Presently slackware's 'updatedb' via cron is a doozy for performance on some of my really old machines, and I want to add in the aide, rkhunter, ossec and logwatch so that should really help having that.

Thanks again.

I'm still so stuck in my windows ways, trying to break the habbits.
Well, if you mean being *cautious* that's not bad. If you value the machine and the time you invested in it you should make regular backups anyway, just use a scheme that allows for full + incremental ones.