Cron is sending me an email once per minute, the emails look like this:
Subject: Cron root@host chown root:root /dev/shm/local/local5 && chmod 4755 /dev/shm/local/local5 && rm -rf /etc/cron.d/core && kill -USR1 7140
Body: chown: cannot access `/dev/shm/local/local5': No such file or directory
I've un-installed and reinstalled the vixie-cron packages, I have verified that they are not corrupted by using rpm --verify vixie-cron, I have checked all the crontabs on the system there aren't any running every minute.
I don't understand why this is happening, anyone have any insight?
Thanks,
Matt
On Sat, 2006-09-02 at 16:25 -0400, Matthew T. O'Connor wrote:
/dev/shm/local
I'd start viewing the /etc/cron* stuff to see if you can see anything there.
And run something like this
rpm -q --file /dev/shm/local
to see if you can find the package with which they are associated.
They're not on my machine, but I'm just a workstation here.
HTH -- Bill
William L. Maltby wrote:
On Sat, 2006-09-02 at 16:25 -0400, Matthew T. O'Connor wrote:
/dev/shm/local
I'd start viewing the /etc/cron* stuff to see if you can see anything there.
And run something like this
rpm -q --file /dev/shm/local
to see if you can find the package with which they are associated.
That file doesn't exist on my system either.
I have looked at all the crontab files that is /etc/cron.* and /var/spool/cron/* to see if there is any entry that is setup to run every minute, and I haven't found one. I'm totally miffed by this.
Matt
On Sat, 2006-09-02 at 19:37 -0400, Matthew T. O'Connor wrote:
William L. Maltby wrote:
On Sat, 2006-09-02 at 16:25 -0400, Matthew T. O'Connor wrote:
/dev/shm/local
I'd start viewing the /etc/cron* stuff to see if you can see anything there.
And run something like this
rpm -q --file /dev/shm/local
to see if you can find the package with which they are associated.
That file doesn't exist on my system either.
I have looked at all the crontab files that is /etc/cron.* and /var/spool/cron/* to see if there is any entry that is setup to run every minute, and I haven't found one. I'm totally miffed by this.
Maybe you can see it in "top"? Or Run the sar reports? As to the one minute intervals, that's not surprising. What happens is cron makes a check every minute (at least it historically used to) to see if there's anything it needs to do. A shared memory segment might be it's way of queuing and tracking? Maybe there's something in /usr/share/doc about it? Or maybe a google?
Matt
<snip sig stuff>
HTH -- Bill
Matthew T. O'Connor wrote:
Cron is sending me an email once per minute, the emails look like this:
Subject: Cron root@host chown root:root /dev/shm/local/local5 && chmod 4755 /dev/shm/local/local5 && rm -rf /etc/cron.d/core && kill -USR1 7140
Body: chown: cannot access `/dev/shm/local/local5': No such file or directory
I've un-installed and reinstalled the vixie-cron packages, I have verified that they are not corrupted by using rpm --verify vixie-cron, I have checked all the crontabs on the system there aren't any running every minute.
I don't understand why this is happening, anyone have any insight?
As root, crontab -l
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Sat, Sep 02, 2006 at 04:25:34PM -0400, Matthew T. O'Connor wrote:
Cron is sending me an email once per minute, the emails look like this:
Subject: Cron root@host chown root:root /dev/shm/local/local5 && chmod 4755 /dev/shm/local/local5 && rm -rf /etc/cron.d/core && kill -USR1 7140
Body: chown: cannot access `/dev/shm/local/local5': No such file or directory
I've un-installed and reinstalled the vixie-cron packages, I have verified that they are not corrupted by using rpm --verify vixie-cron, I have checked all the crontabs on the system there aren't any running every minute.
I don't understand why this is happening, anyone have any insight?
Someone is either trying or already managed to exploit your machine using CVE-2006-2451.
Make sure you are using at least 2.6.9-34.0.2, where this issue was fixed. Any version older than that is vulnerable, and you are in deep trouble.
To manually remove the file that is triggering the cron message, check for a file named core.XXXXX (where XXXXX is a number) inside /etc/cron.d.
- -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)
-
John Summerfield -
Matthew T. O'Connor -
Rodrigo Barbosa -
William L. Maltby