/var/log/secure user activity. also, httpd can not start without two users
Posted
by
user52869
on Server Fault
See other posts from Server Fault
or by user52869
Published on 2011-02-10T06:59:41Z
Indexed on
2011/02/10
7:26 UTC
Read the original article
Hit count: 450
hello,
i found some strange informations in /var/log/secure file:
Feb 10 02:02:04 server2364 usermod[30750]: unlock user `username1' password
Feb 10 02:02:04 server2364 usermod[30811]: lock user `username2' password
Feb 10 02:05:16 server2364 usermod[30992]: unlock user `username2' password
Feb 10 02:05:18 server2364 usermod[31114]: unlock user `username1' password
username1 and username2 are two usernames on system, that have no ability to login.
for every night in 02:02h results like that are in /var/log/secure file.
one more thing: files /etc/shadow, and /etc/shadow have timestamps 02:05h.
what can be cause for it?
next thing, if i remove those two accounts (username1 and username2), i can not start web server.
can you help me with some ideas, am i hacked?
© Server Fault or respective owner
