Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Successful su for man by root
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
SarahS93
Guru
Guru


Joined: 21 Nov 2013
Posts: 543

PostPosted: Mon Mar 02, 2020 9:05 am    Post subject: Successful su for man by root Reply with quote

never see something like this before....

Code:
Mar  2 03:10:01 deruse su[10649]: Successful su for man by root
Mar  2 03:10:01 pc1 su[10649]: + ??? root:man
Mar  2 03:10:01 pc1 su[10649]: pam_unix(su:session): session opened for user man by (uid=0)
Mar  2 03:10:02 pc1 su[10649]: pam_unix(su:session): session closed for user man


what happened?!?!?
Back to top
View user's profile Send private message
Ionen
l33t
l33t


Joined: 06 Dec 2018
Posts: 690

PostPosted: Mon Mar 02, 2020 9:07 am    Post subject: Reply with quote

From /etc/cron.daily/man-db:
Code:
exec su man -s /bin/sh -c 'nice mandb --quiet' 2>/dev/null
(Edit: I'd argue su coming from root shouldn't even be logged, if compromised being root is a bigger problem -- there is alternate options to change the running user from a script but I think su is used for availability safety without relying on setuid, "runuser" is notably not available on a typical non-pam system)
Back to top
View user's profile Send private message
ChrisJumper
Advocate
Advocate


Joined: 12 Mar 2005
Posts: 2281
Location: Germany

PostPosted: Tue Mar 03, 2020 11:23 pm    Post subject: Re: Successful su for man by root Reply with quote

SarahS93 wrote:
never see something like this before....

Code:
Mar  2 03:10:01 deruse su[10649]: Successful su for man by root
Mar  2 03:10:01 pc1 su[10649]: + ??? root:man
Mar  2 03:10:01 pc1 su[10649]: pam_unix(su:session): session opened for user man by (uid=0)
Mar  2 03:10:02 pc1 su[10649]: pam_unix(su:session): session closed for user man


what happened?!?!?


I have zero Strings in my logs like "user man".
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum