sshd killing every minute

S

Sheldon

Verified User
Joined
Dec 23, 2004
Messages
70
Location
Canada
Jan 25 19:03:01 aquila crond(pam_unix)[3981]: session opened for user root by (uid=0)
Jan 25 19:03:01 aquila crond(pam_unix)[3981]: session closed for user root
Jan 25 19:04:01 aquila crond(pam_unix)[3984]: session opened for user root by (uid=0)
Jan 25 19:04:01 aquila crond(pam_unix)[3985]: session opened for user root by (uid=0)
Jan 25 19:04:01 aquila crond(pam_unix)[3985]: session closed for user root
Jan 25 19:04:01 aquila crond(pam_unix)[3984]: session closed for user root
Jan 25 19:05:01 aquila crond(pam_unix)[4009]: session opened for user root by (uid=0)
Jan 25 19:05:01 aquila crond(pam_unix)[4009]: session closed for user root
Jan 25 19:06:01 aquila crond(pam_unix)[4011]: session opened for user root by (uid=0)
Jan 25 19:06:01 aquila crond(pam_unix)[4011]: session closed for user root
Jan 25 19:07:01 aquila crond(pam_unix)[4013]: session opened for user root by (uid=0)
Jan 25 19:07:01 aquila crond(pam_unix)[4013]: session closed for user root
Jan 25 19:08:01 aquila crond(pam_unix)[4015]: session opened for user root by (uid=0)
Jan 25 19:08:01 aquila crond(pam_unix)[4016]: session opened for user root by (uid=0)
Jan 25 19:08:01 aquila crond(pam_unix)[4016]: session closed for user root
Jan 25 19:08:01 aquila crond(pam_unix)[4015]: session closed for user root
Jan 25 19:09:01 aquila crond(pam_unix)[4044]: session opened for user root by (uid=0)
Jan 25 19:09:01 aquila crond(pam_unix)[4044]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4046]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4047]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4051]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4054]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4047]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4054]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4046]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4051]: session closed for user root
Jan 25 19:11:01 aquila crond(pam_unix)[4284]: session opened for user root by (uid=0)
Jan 25 19:11:01 aquila crond(pam_unix)[4284]: session closed for user root
Click to expand...

Whats wrong with this?
 
Can you tell us what you're doing, the resuts you're expecting, and the results you're getting?

That would be much more helpful than just showing us log entries?

Thanks.

Jeff
 
Its just that im not loggin in and logging out every minute. Im logged in and yet its saying its openning a new session every minute.
 
Have you tried tailing your /var/log/secure file for a a minute or two to see whether it's showing login attempts?

Jeff
 
I know it shouldnt be because its on a different port.

[root@aquila ~]# tail /var/log/secure
Jan 25 10:17:09 aquila sshd[4006]: error: Bind to port 8080 on 0.0.0.0 failed: Address already in use.
Jan 25 10:17:40 aquila sshd[4597]: Accepted password for root from ::ffff:192.197.62.99 port 42198 ssh2
Jan 25 13:44:16 aquila sshd[23216]: Accepted password for root from ::ffff:192.197.62.99 port 16650 ssh2
Jan 25 15:57:04 aquila sshd[28515]: Accepted publickey for root from ::ffff:24.244.241.217 port 62508 ssh2
Jan 25 17:57:23 aquila sshd[763]: Accepted publickey for root from ::ffff:24.244.241.217 port 63623 ssh2
Jan 25 19:11:55 aquila sshd[4288]: Accepted publickey for root from ::ffff:24.244.241.217 port 60261 ssh2
Jan 25 19:13:29 aquila sshd[4006]: Received signal 15; terminating.
Jan 25 19:13:30 aquila sshd[4464]: Server listening on :: port 8080.
Jan 25 19:13:30 aquila sshd[4464]: error: Bind to port 8080 on 0.0.0.0 failed: Address already in use.
Jan 25 19:42:13 aquila sshd[5345]: Accepted publickey for root from ::ffff:24.244.241.217 port 60439 ssh2
Click to expand...
 
I don't have an answer for you; you should probably post on an OS-specific users group.

Jeff
 
In your first post, it looks like crond is logging something every minute, not sshd.
Check if you have a file named /var/spool/cron/root or any files in /etc/cron.d. They are causing the log messages.
 
You must log in or register to reply here.
Back
Top