Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just check my logs on my deed server, I spotted some weird log in the auth.log:

Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session opened for user user by (uid=0)
Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session closed for user user
Jun 17 22:28:01 mutualab CRON[16253]: pam_unix(cron:session): session opened for user user by (uid=0)
Jun 17 22:28:01 mutualab CRON[16253]: pam_unix(cron:session): session closed for user alain
Jun 17 22:29:01 mutualab CRON[16257]: pam_unix(cron:session): session opened for user user by (uid=0)
Jun 17 22:29:01 mutualab CRON[16257]: pam_unix(cron:session): session closed for user user

Looks like somebody tried to log in - and succeeded ? - but delog instantly ? I got the same log for hours now...

Do you know what happens?

share|improve this question

1 Answer 1

up vote 11 down vote accepted

That's just cron running the cronjobs. It opens (and then closes) a PAM session for the appropriate user when it executes commands. Based on the timestamps, you have a cronjob which executes every minute.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.