Ubuntu

Why does root open a session every hour?

Asked by Jim Hutchinson

I have another sort of mystery. In the course of setting up ssh I have been monitoring the auth.log. I noticed that every hour there is a cron job that opens a root session that last all of 1 second. Does anyone know what this about, why it does it and if it's normal or not? Here is a sample from the log.

Aug 20 13:17:01 feisty CRON[5871]: (pam_unix) session opened for user root by (uid=0)
Aug 20 13:17:01 feisty CRON[5871]: (pam_unix) session closed for user root
Aug 20 14:17:01 feisty CRON[5879]: (pam_unix) session opened for user root by (uid=0)
Aug 20 14:17:01 feisty CRON[5879]: (pam_unix) session closed for user root

I do not even have a root user login set up.

Thanks.

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
Gord Allott
Solved:
Last query:
Last reply:
Revision history for this message
Best Gord Allott (gordallott) said : 		#1

yeah its normal, don't worry about it. its just cron doing that, cron runs as root by default

Revision history for this message
Jim Hutchinson (jphutch) said : 		#2

Well, that's good to know. Opening ports for ssh and all I've been a bit paranoid. Although, I'd like to know what the heck it's doing and why.

Revision history for this message
Bhavani Shankar (bhavi) said : 		#3

Yes... Its normal and happens on my system also.... Because the server key will be regenerated automatically by an alarm every hour...

Revision history for this message
Jim Hutchinson (jphutch) said : 		#4

Thanks Gord Allott, that solved my question.

Revision history for this message
Jim Hutchinson (jphutch) said : 		#5

Well, I guess this is solved my problem/question since it seems this is normal and nothing to worry about. However, I'm not sure what "the server key will be regenerated automatically by an alarm every hour" means or why there is an alarm every hour. This certainly isn't something I've set up so I guess it's part of the way Ubuntu/Linux just works. The word "alarm" is, however, alarming. That usually means a bad thing.

Anyway, thanks for the feedback. If either of you have any more insights please let me know. Thanks.

Revision history for this message
Bhavani Shankar (bhavi) said : 		#6

Yes Thats how OpenSSH works... There is nothing such as a BAD THING by an alarm....