Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error.

Mar 12 06:50:10 bigbugz02 su[13762]: Successful su for www-data by root
Mar 12 06:50:10 bigbugz02 su[13762]: + ??? root:www-data
Mar 12 06:50:10 bigbugz02 su[13762]: pam_unix(su:session): session opened for user www-data by (uid=0)
Mar 12 06:50:12 bigbugz02 su[13762]: pam_unix(su:session): session closed for user www-data
share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

This is a frequently asked question in Secure Debian guide. Here is some more info on the topic:

See point 11.2.3 here

Generally it could be a cron job. So - it is safe.

share|improve this answer
    
Thanks a lot buddy :) I was tensed. –  Caterpillar Mar 12 '12 at 11:48
1  
Yeah...the logs can be frightening :) –  TheMouse Mar 12 '12 at 12:14
add comment

This is generally a safe thing. When the application is started by root user it does this to start it as www-data user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.