Curious Log File Entry

[Ben Beeson]

Now there is an interesting thought.....

Ben 


On Wed, 28 Mar 2001, you wrote:
> It might be from your logrotate cron job.
> 
> -----Original Message-----
> From: Ben Beeson [mailto:beesond001 at hawaii.rr.com]
> Sent: Tuesday, March 27, 2001 11:42 PM
> To: Linux & Unix Advocates & Users
> Subject: [luau] Curious Log File Entry
> 
> 
> Aloha all,
> 
> 	Does anyone have any clue how the below entry could end up in my log
> files?  I am pretty sure no one here tried to log in as user "news" at 4
> a.m......  This is curious because I've never seen this one before.  Should
> I
> block news (port 119) in my firewall????
> 
>  grep news /var/log/messages
> Mar 25 04:03:42 [My IP Address Here ] PAM_pwdb[1442]: (su) session opened
> for
> user news by (uid=0)
> 
> Mar 25 04:03:42 [My IP Address Here ] pam_xauth[1442]:
> do_file: could not create dir /var/spool/news/.xauth
> 
> Mar 25 04:03:42 [My IP Address Here ]
> PAM_pwdb[1442]: (su) session closed for user news
> 
> Mar 25 4:03:42 [My IP Address Here ] pam_xauth[1442]: do_file: could not
> create dir /var/spool/news/.xauth
> 
> Mar 27 04:02:17 localhost PAM_pwdb[6857]:
> (su) session opened for user news by (uid=0) Mar 27 04:02:17 localhost
> PAM_pwdb[6857]: (su) session closed for user news
> 
> 
> 
> Thanks,
> 
> Ben
> 
> ---
> You are currently subscribed to luau as: garcian002 at hawaii.rr.com
> To unsubscribe send a blank email to $subst('Email.Unsub')
> 
> 
> ---
> You are currently subscribed to luau as: beesond001 at hawaii.rr.com
> To unsubscribe send a blank email to $subst('Email.Unsub')