Вопросы Теги

“Успешный su для пользователя корнем” - подозрительные записи в моем /var/log/auth.log?

Это сообщение на reddit заставило меня пройти свои журналы. Именно тогда я обнаружил следующие записи, которые появились в два непоследующих дня. "пользователь" является моей учетной записью пользователя.

Aug  4 22:50:37 UbuntuSystem sudo: pam_unix(sudo:session): session opened for user root by user(uid=1000)
Aug  4 22:50:39 UbuntuSystem sudo: pam_unix(sudo:session): session closed for user root
Aug  4 22:51:16 UbuntuSystem su[10710]: Successful su for user by root
Aug  4 22:51:16 UbuntuSystem su[10710]: + ??? root:user
Aug  4 22:51:16 UbuntuSystem su[10710]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10710]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10720]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10720]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10720]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10720]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10735]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10735]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10735]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10735]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10763]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10763]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10763]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10763]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10773]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10773]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10773]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10773]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10788]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10788]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10788]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10788]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10801]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10801]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10801]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10801]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10814]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10814]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10814]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10814]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10829]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10829]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10829]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10829]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10842]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10842]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10842]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10842]: pam_unix(su:session): session closed for user user
Aug  4 22:51:17 UbuntuSystem su[10855]: Successful su for user by root
Aug  4 22:51:17 UbuntuSystem su[10855]: + ??? root:user
Aug  4 22:51:17 UbuntuSystem su[10855]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 22:51:17 UbuntuSystem su[10855]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11153]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11153]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11153]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11153]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11166]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11166]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11166]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11166]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11181]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11181]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11181]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11181]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11193]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11193]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11193]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11193]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11211]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11211]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11211]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11211]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11226]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11226]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11226]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11226]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11241]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11241]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11241]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11241]: pam_unix(su:session): session closed for user user
Aug  4 23:41:39 UbuntuSystem su[11253]: Successful su for user by root
Aug  4 23:41:39 UbuntuSystem su[11253]: + ??? root:user
Aug  4 23:41:39 UbuntuSystem su[11253]: pam_unix(su:session): session opened for user user by (uid=0)
Aug  4 23:41:39 UbuntuSystem su[11253]: pam_unix(su:session): session closed for user user
Aug  4 23:42:18 UbuntuSystem gnome-screensaver-dialog: gkr-pam: unlocked login keyring
Aug  4 23:42:33 UbuntuSystem polkitd(authority=local): Unregistered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session2 (system bus name :1.48, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)

Aug 15 20:17:01 UbuntuSystem CRON[26579]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 15 20:17:01 UbuntuSystem CRON[26579]: pam_unix(cron:session): session closed for user root
Aug 15 21:15:15 UbuntuSystem su[27098]: Successful su for user by root
Aug 15 21:15:15 UbuntuSystem su[27098]: + ??? root:user
Aug 15 21:15:15 UbuntuSystem su[27098]: pam_unix(su:session): session opened for user user by (uid=0)
Aug 15 21:15:15 UbuntuSystem su[27098]: pam_unix(su:session): session closed for user user
Aug 15 21:17:01 UbuntuSystem CRON[27141]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 15 21:17:01 UbuntuSystem CRON[27141]: pam_unix(cron:session): session closed for user root

Кроме этих повторений единственные другие времена я нашел, что подобный вывод был при испытании гостевой учетной записи:

Aug 11 22:38:49 UbuntuSystem lightdm: pam_unix(lightdm:session): session closed for user lightdm
Aug 11 22:38:49 UbuntuSystem groupadd[2918]: group added to /etc/group: name=guest-4Eflre, GID=125
Aug 11 22:38:49 UbuntuSystem groupadd[2918]: group added to /etc/gshadow: name=guest-4Eflre
Aug 11 22:38:49 UbuntuSystem groupadd[2918]: new group: name=guest-4Eflre, GID=125
Aug 11 22:38:50 UbuntuSystem useradd[2922]: new user: name=guest-4Eflre, UID=115, GID=125, home=/, shell=/bin/bash
Aug 11 22:38:50 UbuntuSystem usermod[2927]: change user 'guest-4Eflre' password
Aug 11 22:38:50 UbuntuSystem chage[2932]: changed password expiry for guest-4Eflre
Aug 11 22:38:50 UbuntuSystem chfn[2935]: changed user 'guest-4Eflre' information
Aug 11 22:38:50 UbuntuSystem usermod[2943]: change user 'guest-4Eflre' home from '/' to '/tmp/guest-4Eflre'
Aug 11 22:38:50 UbuntuSystem su[2948]: Successful su for guest-4Eflre by root
Aug 11 22:38:50 UbuntuSystem su[2948]: + ??? root:guest-4Eflre
Aug 11 22:38:50 UbuntuSystem su[2948]: pam_unix(su:session): session opened for user guest-4Eflre by (uid=0)
Aug 11 22:38:50 UbuntuSystem su[2948]: pam_unix(su:session): session closed for user guest-4Eflre
Aug 11 22:38:50 UbuntuSystem lightdm: pam_unix(lightdm-autologin:session): session opened for user guest-4Eflre by (uid=0)
Aug 11 22:38:50 UbuntuSystem lightdm: pam_ck_connector(lightdm-autologin:session): nox11 mode, ignoring PAM_TTY :0

Мне, возможно, придется добавить, что я настроил свою систему только справедливо недавно (4 августа).

Действительно ли это поведение нормально? Что точно продолжает все команды su? Я должен волноваться, что моя система могла бы быть поставлена под угрозу?

Заранее большое спасибо.

7
задан 4 April 2013 в 19:15

3 ответа

Те предупреждения состоят в том, когда Вы swith от корня до Вашего пользователя

не кажется, что у Вас есть любая проблема.

7
ответ дан 4 April 2013 в 19:15

Я думаю, что, возможно, нашел по крайней мере одного из преступников: 

Aug 21 16:15:09 UbuntuSystem su[30135]: Successful su for user by root
Aug 21 16:15:09 UbuntuSystem su[30135]: + ??? root:user
Aug 21 16:15:09 UbuntuSystem su[30135]: pam_unix(su:session): session opened for user user by (uid=0)
Aug 21 16:15:09 UbuntuSystem su[30135]: pam_unix(su:session): session closed for user user
Aug 21 16:15:09 UbuntuSystem sudo: pam_unix(sudo:session): session closed for user root
Aug 21 16:15:12 UbuntuSystem sudo:      user : TTY=unknown ; PWD=/home/user ; USER=root ; COMMAND=/usr/lib/jupiter/scripts/cpu-control high
Aug 21 16:15:12 UbuntuSystem sudo: pam_unix(sudo:session): session opened for user root by (uid=1000)
Aug 21 16:15:12 UbuntuSystem su[30174]: Successful su for user by root
Aug 21 16:15:12 UbuntuSystem su[30174]: + ??? root:user
Aug 21 16:15:12 UbuntuSystem su[30174]: pam_unix(su:session): session opened for user user by (uid=0)
Aug 21 16:15:12 UbuntuSystem su[30174]: pam_unix(su:session): session closed for user user
Aug 21 16:15:12 UbuntuSystem sudo: pam_unix(sudo:session): session closed for user root

В этом случае записи были подключены к апплету питания Юпитера и конкретно появились при изменении режима мощности ЦП. Как не было никакого упоминания о Юпитере ни в одном из других экземпляров, я не могу быть уверен, могут ли они быть приписаны тому же процессу.

я буду продолжать контролировать свои журналы и отправлять дальнейшие результаты здесь.

2
ответ дан 4 April 2013 в 19:15

Это не от того, когда Вы работаете sudo. Но они не проблема, также.

В сообщениях говорится:

Successful su for user by root

Это происходит каждый раз, когда Вы входите в систему. Входите ли Вы в систему как реальный пользователь или как гостевой пользователь, экран входа в систему работает как root, таким образом, это должно изменить пользовательские идентификационные данные от root к не -root пользователь как часть процесса входа в систему.

Это не user становление root. Это root становление user.

5
ответ дан 4 April 2013 в 19:15

Другие вопросы по тегам:

Похожие вопросы: