1

I see the following in /var/log/auth.log (system is current Ubuntu).

myserver su[14993]: illegal option minimum_uid=1000
myserver su[14993]: Successful su for jeanbon by root
myserver su[14993]: + ??? root:jeanbon
myserver su[14993]: pam_unix(su:session): session opened for user jeanbon by (uid=0)
myserver systemd-logind[1931]: New session c253 of user jeanbon.
myserver systemd: pam_unix(systemd-user:session): session opened for user jeanbon by (uid=0)
myserver su[14993]: pam_unix(su:session): session closed for user jeanbon
myserver systemd-logind[1931]: Removed session c253.

Does it mean that user jeanbon has become root using the su command ? This user cannot use sudo and tells me he doesn't know the root password. There are many similar logs in rapid succession, for 4 different users at various times.

1 Answer 1

2

These log entries indicate that the root user became jeanbon, not that jeanbon became root.

2
  • So is it some kind of login process ?
    – dargaud
    Jun 18, 2019 at 19:03
  • @dargaud It's a pretty typical usage for su. It is, after all, for switching users. If you want to know why it happened, you should ask the administrator who did it. Logs can't always say why a human being took an action. Jun 18, 2019 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .