Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
what is "test -x /usr/sbin/run-crons && /usr/sbin/run-crons"
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Duplicate Threads
View previous topic :: View next topic  
Author Message
Richard
n00b
n00b


Joined: 21 Nov 2002
Posts: 34
Location: Australia

PostPosted: Fri Jun 01, 2007 3:35 am    Post subject: what is "test -x /usr/sbin/run-crons && /usr/sb Reply with quote

Hi,

I have been running a little web server for a few years and last night it sent me an email that was new to me. The body reads:

Quote:
which: no curl in (/sbin:/bin:/usr/sbin:/usr/bin)
--05:30:02-- http://pciids.sourceforge.net/v2.2/pci.ids.bz2
=> `/usr/share/misc/pci.ids.new'
Resolving pciids.sourceforge.net... 66.35.250.209
Connecting to pciids.sourceforge.net|66.35.250.209|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 121,316 (118K) [text/plain]

0K .......... .......... .......... .......... .......... 42% 53.8K 0:01
50K .......... .......... .......... .......... .......... 84% 210K
100K .......... ........ 100% 92.4K

05:30:04 (86.65 KB/s) - `/usr/share/misc/pci.ids.new' saved [121316/121316]

Done.


This is kicked off by the following entry in /etc/crontab

Code:
*/10  *  * * *  root    test -x /usr/sbin/run-crons && /usr/sbin/run-crons


It doesn't look malicious, but it is a bit odd. Anyone know why it is there and why it suddenly activated?

regards
richard
Back to top
View user's profile Send private message
lost+found
Guru
Guru


Joined: 15 Nov 2004
Posts: 402
Location: North~Sea~Coa~s~~t~~~

PostPosted: Fri Jun 01, 2007 5:41 am    Post subject: Re: what is "test -x /usr/sbin/run-crons && /us Reply with quote

Hi,

Quote:
which: no curl in (/sbin:/bin:/usr/sbin:/usr/bin)
--05:30:02-- http://pciids.sourceforge.net/v2.2/pci.ids.bz2
=> `/usr/share/misc/pci.ids.new'
Resolving pciids.sourceforge.net... 66.35.250.209
Connecting to pciids.sourceforge.net|66.35.250.209|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 121,316 (118K) [text/plain]

0K .......... .......... .......... .......... .......... 42% 53.8K 0:01
50K .......... .......... .......... .......... .......... 84% 210K
100K .......... ........ 100% 92.4K

05:30:04 (86.65 KB/s) - `/usr/share/misc/pci.ids.new' saved [121316/121316]

Done.


This is output of the cron "/etc/cron.monthly/update-pciids", which "downloads new version of the PCI ID list" the manual says... I guess that's for new hardware support :)

Quote:
Code:
*/10  *  * * *  root    test -x /usr/sbin/run-crons && /usr/sbin/run-crons
Test checks if the run-crons script is executable (executable bit on), if so then it will be run. Nothing new, worked always this way.
Back to top
View user's profile Send private message
Richard
n00b
n00b


Joined: 21 Nov 2002
Posts: 34
Location: Australia

PostPosted: Fri Jun 01, 2007 6:07 am    Post subject: Reply with quote

Thanks for the comforting news. Perhaps my email filters have started sorting it differently, so I have suddenly seen it.

regards
Richard
Back to top
View user's profile Send private message
desultory
Administrator
Administrator


Joined: 04 Nov 2005
Posts: 7820

PostPosted: Sat Jun 02, 2007 5:53 am    Post subject: Reply with quote

Moved from Networking & Security to Duplicate Threads, as thisissue was already discussed in topic "Unexpected cron output - could it be a system compromise?".
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Duplicate Threads All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum