Hi,

I'm learning sys administration using a Linode (Ubuntu 8.04). I'm in the chapter of keeping an eye on the most important log files.

Apart from the regular log output, I have some lines that I can't understand... even after searching the forums or asking google.

1. auth.log

Sep  5 03:17:01 serverone CRON[7929]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep  5 03:17:01 serverone CRON[7929]: pam_unix(cron:session): session closed for user root
Sep  5 04:17:01 serverone CRON[7932]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep  5 04:17:02 serverone CRON[7932]: pam_unix(cron:session): session closed for user root

As you can see, in the 17th minute of every hour, even if I'm logged in, those keep appearing in the auth.log.

2. messages/syslog

Sep  5 00:19:56 serverone kernel: [UFW BLOCK INPUT]: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=14332 DF PROTO=TCP SPT=1633 DPT=5900 WINDOW=64240 RES=0x00 SYN URGP=0 

Everyday messages and syslog log around 200 attempts of intrusion (??) blocked by ufw... but I think I shouldn't be concerned, since I've just a custom SSH port and HTTP:80 open. Am I right?

3. syslog

Sep  5 16:25:32 serverone dhclient: DHCPREQUEST of <null address> on eth0 to xxx.xxx.xxx.xxx port 67
Sep  5 16:25:32 serverone dhclient: DHCPACK of xxx.xxx.xxx.xxx from xxx.xxx.xxx.xxx
Sep  5 16:25:32 serverone dhclient: bound to xxx.xxx.xxx.xxx -- renewal in 35962 seconds.

These lines are the most strange ones and I think they're related with Linode's Ubuntu. I can't find their meaning!

4. syslog

Sep  5 21:17:01 serverone /USR/SBIN/CRON[8598]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)

I think this line is related with the auth.log problem as it happens every 17th minute of each hour.

I'll be much appreciated if you can give some enlightenment around the described issues. Thanks a lot.

Numbers 1 and 4 are definitely related; at 17 minutes past the hour, your system is doing hourly maintenance (e.g. running everything in /etc/cron.hourly). Totally normal.

Number 2 is indeed a firewall hit... someone at SRC port SPT tried to connect to you, DST, on port DPT. The "UFW BLOCK INPUT" indicates that it was blocked, so it can be safely ignored.

Number 3 is the DHCP client on your system renewing the lease of its IP address. This is also normal.

So, yep, normal routine system chatter

Thank you, hoopycat.

Regarding 1 and 4, I checked the /etc/crontab and, indeed, there's a job running every hour on minute 17.

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

That is just the normal default cron schema, Any scripts or links to scripts in those folders would be executed.