10

This post is somewhat similar but mine is rather specific.

CRON: pam_unix(cron:session): session opened for user root by (uid=0)

Is this really a bug? In our system this process is creating entries in every 5 minutes making the log backup guys' life very hard. Lots & lots of entries are being stored on the disk.

As per the following links, do we need to fix this issue or can we at least increase the time of listing between the entries?

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=293272

http://languor.us/cron-pam-unix-cron-session-session-opened-closed-user-root-uid0

Can I at least reduce the time between entries? For my server currently it's 1 pair of entry in every 5 minutes. Say, I've increased the time to 30 minutes, would I miss any login attempt (legit and hacking both)?

2 Answers 2

16

The entries are added to the log each time a cron job runs. To reduce the time between entries, you would have to look at your cron jobs and change their timings. This, though, may break something that relies on those jobs running at specific intervals.

If they really do annoy you, then simply follow the instructions on the Debian bug report and stop cron from logging an entry in the auth.log each time a job runs. That is, edit /etc/pam.d/common-session-noninteractive and add:

session     [success=1 default=ignore] pam_succeed_if.so service in cron quiet use_uid

before the line: session required pam_unix.so

and restart the cron service (as per links provided by original poster)

1
  • 1
    any way to make this persistent through updates? that doesn't seem a safe file to edit like this
    – filippo
    Mar 9, 2021 at 19:30
0

You Want To Have That Log Message

I would make the argument that because this log message tells you every single time that a cron job runs as root, which could be potentially malicious, it should be considered a "must have" process.

Disable the cron jobs

Something that I've noticed throughout my times installing fresh linux distros is that some flavors come with a few cron jobs enabled. So if you don't want to have random bash scripts running on your system you're going to want to disable them.

Cron jobs can run from multiple places. So the first place you want to check is the user cronjobs. To check if any exist, you can use the following bash script:

#! /bin/bash
for user in $(awk -F':' '{ print $1}' /etc/passwd)
do
        sudo crontab -u $user -l
done

If you see that a user has crontabs, run the command sudo crontab -u TargetUsername -e, and then comment out all the lines using #

Anacron

Some systems will come with anacron installed and you will typically see job entries relating to anacron inside the file /etc/crontab. You can open this file and comment out all the entries here as well. I usually use Vim to edit this file, for example, sudo vim /etc/crontab

Anacron also runs via a service timer. So to further shut off the anacron jobs you need to disable anacron.timer. To see the current running timers, run the command: systemctl list-timers

If you see anacron in the list, you can stop it temporally with sudo systemctl stop anacron.timer. To stop it permanently run sudo systemctl mask anacron.timer

You can also stop the anacron service the same way, if it's running.

Cleaning Up Leftovers

There is one more directory to check for cron jobs, /etc/cron.d. you can edit these files just like the "/etc/crontab" file by using Vim, Nano, or other file editor. Just comment out the lines in each of the files using #, save, and then close.

Testing The Changes

How I like to test is by running tail -f /var/log/auth.log. If anything stops working, you should be able to "un-comment" the lines you modified; but mission critical things, depending on the system, may be handled as a timed service, like we see with anacron, so it should be fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .