Is this an attack or a proper system process

**afewtips** · 05-01-2008, 09:47 AM

Hi,
I have setup a new server and within a day I was getting brute force attacks.
I removed root access and I modified my iptables to keep the number of tries within a min to 8, but now I see these lines -

pam_unix(cron:session): session opened for user root by (uid=0)

Is this a normal line or something else?

Thanks for any help.

**crashed** · 05-01-2008, 07:30 PM

Nope, as it says "cron:session" it means that it is cron (scheduled) jobs that are running regulary.

Pretty normal.

**afewtips** · 05-05-2008, 09:39 AM

Thanks for the reply -
I am using fail2ban now as well.

Thanks

**ramilB** · 05-06-2008, 07:28 AM

crashed is right, it is just a cron job probably set your script or have you set a cron job?

05-01-2008, 07:30 PM	#2 (permalink) Re: Is this an attack or a proper system process
crashed Average Talker Posts: 15 Name: Chris Location: UK Talkupation:	Nope, as it says "cron:session" it means that it is cron (scheduled) jobs that are running regulary. Pretty normal. __________________ Chris .Net C# ASP.NET Developer Windows Systems Administrator

05-01-2008, 09:47 AM	#1 (permalink) Is this an attack or a proper system process
afewtips Junior Talker Posts: 4 Talkupation:	Hi, I have setup a new server and within a day I was getting brute force attacks. I removed root access and I modified my iptables to keep the number of tries within a min to 8, but now I see these lines - pam_unix(cron:session): session opened for user root by (uid=0) Is this a normal line or something else? Thanks for any help.

05-05-2008, 09:39 AM	#3 (permalink) Re: Is this an attack or a proper system process
afewtips Junior Talker Posts: 4 Talkupation:	Thanks for the reply - I am using fail2ban now as well. Thanks

05-06-2008, 07:28 AM	#4 (permalink) Re: Is this an attack or a proper system process
ramilB Novice Talker Posts: 10 Name: Ramil Talkupation:	crashed is right, it is just a cron job probably set your script or have you set a cron job?