/var/log/auth.log странная активность, не моя...

[kabukki]

Товарищи корифеи, подскажите пожалуйста, если подключен интернет, работает torrent клиент, но я при этом сплю, и ничего не трогаю, а в логе шевеление какое-то... Это нормально?

(Нажмите, чтобы показать/скрыть)

Jul 21 00:20:01 demon-laptop CRON[19103]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 00:20:01 demon-laptop CRON[19103]: pam_unix(cron:session): session closed for user root
Jul 21 00:25:46 demon-laptop sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=demon
Jul 21 00:30:01 demon-laptop CRON[19738]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 00:30:02 demon-laptop CRON[19738]: pam_unix(cron:session): session closed for user root
Jul 21 00:40:01 demon-laptop CRON[20336]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 00:40:01 demon-laptop CRON[20336]: pam_unix(cron:session): session closed for user root
Jul 21 00:50:01 demon-laptop CRON[20960]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 00:50:01 demon-laptop CRON[20960]: pam_unix(cron:session): session closed for user root
Jul 21 01:00:01 demon-laptop CRON[21553]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:00:01 demon-laptop CRON[21554]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:00:01 demon-laptop CRON[21553]: pam_unix(cron:session): session closed for user root
Jul 21 01:00:01 demon-laptop CRON[21554]: pam_unix(cron:session): session closed for user root
Jul 21 01:10:01 demon-laptop CRON[22239]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:10:02 demon-laptop CRON[22239]: pam_unix(cron:session): session closed for user root
Jul 21 01:17:01 demon-laptop CRON[22724]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:17:01 demon-laptop CRON[22724]: pam_unix(cron:session): session closed for user root
Jul 21 01:20:01 demon-laptop CRON[22851]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:20:01 demon-laptop CRON[22851]: pam_unix(cron:session): session closed for user root
Jul 21 01:30:01 demon-laptop CRON[23456]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:30:01 demon-laptop CRON[23456]: pam_unix(cron:session): session closed for user root
Jul 21 01:40:01 demon-laptop CRON[24049]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:40:01 demon-laptop CRON[24049]: pam_unix(cron:session): session closed for user root
Jul 21 01:50:01 demon-laptop CRON[24635]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 01:50:01 demon-laptop CRON[24635]: pam_unix(cron:session): session closed for user root
Jul 21 02:00:01 demon-laptop CRON[25233]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:00:01 demon-laptop CRON[25232]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:00:02 demon-laptop CRON[25232]: pam_unix(cron:session): session closed for user root
Jul 21 02:00:02 demon-laptop CRON[25233]: pam_unix(cron:session): session closed for user root
Jul 21 02:10:01 demon-laptop CRON[25964]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:10:01 demon-laptop CRON[25964]: pam_unix(cron:session): session closed for user root
Jul 21 02:17:01 demon-laptop CRON[26437]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:17:01 demon-laptop CRON[26437]: pam_unix(cron:session): session closed for user root
Jul 21 02:20:01 demon-laptop CRON[26686]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:20:01 demon-laptop CRON[26686]: pam_unix(cron:session): session closed for user root
Jul 21 02:30:01 demon-laptop CRON[27283]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:30:02 demon-laptop CRON[27283]: pam_unix(cron:session): session closed for user root
Jul 21 02:40:01 demon-laptop CRON[27876]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:40:01 demon-laptop CRON[27876]: pam_unix(cron:session): session closed for user root
Jul 21 02:50:01 demon-laptop CRON[28469]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 02:50:01 demon-laptop CRON[28469]: pam_unix(cron:session): session closed for user root
Jul 21 03:00:01 demon-laptop CRON[29062]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:00:01 demon-laptop CRON[29063]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:00:01 demon-laptop CRON[29062]: pam_unix(cron:session): session closed for user root
Jul 21 03:00:02 demon-laptop CRON[29063]: pam_unix(cron:session): session closed for user root
Jul 21 03:10:01 demon-laptop CRON[29759]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:10:01 demon-laptop CRON[29759]: pam_unix(cron:session): session closed for user root
Jul 21 03:17:01 demon-laptop CRON[30236]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:17:01 demon-laptop CRON[30236]: pam_unix(cron:session): session closed for user root
Jul 21 03:20:01 demon-laptop CRON[30493]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:20:01 demon-laptop CRON[30493]: pam_unix(cron:session): session closed for user root
Jul 21 03:30:01 demon-laptop CRON[31095]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:30:01 demon-laptop CRON[31095]: pam_unix(cron:session): session closed for user root
Jul 21 03:40:01 demon-laptop CRON[31731]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:40:02 demon-laptop CRON[31731]: pam_unix(cron:session): session closed for user root
Jul 21 03:50:01 demon-laptop CRON[32324]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 03:50:01 demon-laptop CRON[32324]: pam_unix(cron:session): session closed for user root
Jul 21 04:00:01 demon-laptop CRON[448]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:00:01 demon-laptop CRON[447]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:00:01 demon-laptop CRON[447]: pam_unix(cron:session): session closed for user root
Jul 21 04:00:01 demon-laptop CRON[448]: pam_unix(cron:session): session closed for user root
Jul 21 04:10:01 demon-laptop CRON[1162]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:10:01 demon-laptop CRON[1162]: pam_unix(cron:session): session closed for user root
Jul 21 04:17:01 demon-laptop CRON[1648]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:17:01 demon-laptop CRON[1648]: pam_unix(cron:session): session closed for user root
Jul 21 04:20:01 demon-laptop CRON[1897]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:20:02 demon-laptop CRON[1897]: pam_unix(cron:session): session closed for user root
Jul 21 04:30:01 demon-laptop CRON[2508]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:30:01 demon-laptop CRON[2508]: pam_unix(cron:session): session closed for user root
Jul 21 04:40:01 demon-laptop CRON[3195]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:40:01 demon-laptop CRON[3195]: pam_unix(cron:session): session closed for user root
Jul 21 04:50:01 demon-laptop CRON[3880]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 04:50:01 demon-laptop CRON[3880]: pam_unix(cron:session): session closed for user root
Jul 21 05:00:01 demon-laptop CRON[4485]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:00:01 demon-laptop CRON[4486]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:00:01 demon-laptop CRON[4485]: pam_unix(cron:session): session closed for user root
Jul 21 05:00:01 demon-laptop CRON[4486]: pam_unix(cron:session): session closed for user root
Jul 21 05:10:01 demon-laptop CRON[5195]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:10:02 demon-laptop CRON[5195]: pam_unix(cron:session): session closed for user root
Jul 21 05:17:01 demon-laptop CRON[5672]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:17:01 demon-laptop CRON[5672]: pam_unix(cron:session): session closed for user root
Jul 21 05:20:01 demon-laptop CRON[5925]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:20:01 demon-laptop CRON[5925]: pam_unix(cron:session): session closed for user root
Jul 21 05:30:01 demon-laptop CRON[6522]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:30:01 demon-laptop CRON[6522]: pam_unix(cron:session): session closed for user root
Jul 21 05:40:01 demon-laptop CRON[7123]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:40:01 demon-laptop CRON[7123]: pam_unix(cron:session): session closed for user root
Jul 21 05:50:01 demon-laptop CRON[7716]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 05:50:02 demon-laptop CRON[7716]: pam_unix(cron:session): session closed for user root
Jul 21 06:00:01 demon-laptop CRON[8353]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:00:01 demon-laptop CRON[8352]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:00:01 demon-laptop CRON[8352]: pam_unix(cron:session): session closed for user root
Jul 21 06:00:01 demon-laptop CRON[8353]: pam_unix(cron:session): session closed for user root
Jul 21 06:10:01 demon-laptop CRON[9041]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:10:01 demon-laptop CRON[9041]: pam_unix(cron:session): session closed for user root
Jul 21 06:17:01 demon-laptop CRON[9522]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:17:01 demon-laptop CRON[9522]: pam_unix(cron:session): session closed for user root
Jul 21 06:20:01 demon-laptop CRON[9775]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:20:01 demon-laptop CRON[9775]: pam_unix(cron:session): session closed for user root
Jul 21 06:25:01 demon-laptop CRON[10179]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:25:01 demon-laptop CRON[10179]: pam_unix(cron:session): session closed for user root
Jul 21 06:30:01 demon-laptop CRON[10386]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:30:02 demon-laptop CRON[10386]: pam_unix(cron:session): session closed for user root
Jul 21 06:40:01 demon-laptop CRON[10983]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:40:01 demon-laptop CRON[10983]: pam_unix(cron:session): session closed for user root
Jul 21 06:50:01 demon-laptop CRON[11577]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 06:50:01 demon-laptop CRON[11577]: pam_unix(cron:session): session closed for user root
Jul 21 07:00:01 demon-laptop CRON[12171]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:00:01 demon-laptop CRON[12172]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:00:01 demon-laptop CRON[12171]: pam_unix(cron:session): session closed for user root
Jul 21 07:00:01 demon-laptop CRON[12172]: pam_unix(cron:session): session closed for user root
Jul 21 07:10:01 demon-laptop CRON[12927]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:10:02 demon-laptop CRON[12927]: pam_unix(cron:session): session closed for user root
Jul 21 07:17:01 demon-laptop CRON[13443]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:17:01 demon-laptop CRON[13443]: pam_unix(cron:session): session closed for user root
Jul 21 07:20:01 demon-laptop CRON[13692]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:20:01 demon-laptop CRON[13692]: pam_unix(cron:session): session closed for user root
Jul 21 07:30:01 demon-laptop CRON[14286]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:30:01 demon-laptop CRON[14285]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:30:01 demon-laptop CRON[14286]: pam_unix(cron:session): session closed for user root
Jul 21 07:30:01 demon-laptop CRON[14285]: pam_unix(cron:session): session closed for user root
Jul 21 07:40:01 demon-laptop CRON[15029]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:40:02 demon-laptop CRON[15029]: pam_unix(cron:session): session closed for user root
Jul 21 07:50:01 demon-laptop CRON[15625]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 07:50:01 demon-laptop CRON[15625]: pam_unix(cron:session): session closed for user root
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/use_http_proxy
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/host
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/port
Jul 21 08:00:01 demon-laptop CRON[16325]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 08:00:01 demon-laptop CRON[16326]: pam_unix(cron:session): session opened for user root by (uid=0)
Jul 21 08:00:01 demon-laptop CRON[16325]: pam_unix(cron:session): session closed for user root
Jul 21 08:00:03 demon-laptop CRON[16326]: pam_unix(cron:session): session closed for user root

Пользователь решил продолжить мысль 21 Июля 2009, 20:58:47:Клиент - Transmission, Gufw настроен на запретить весь входящий трафик, настроено только одно правило, причем из списка предустановленных. Согласно правилу только для Transmission открыт порт.
Пользователь решил продолжить мысль 22 Июля 2009, 00:20:17:Прошу прощения, может вопрос глупый? Я честно говоря не в курсе, могу и глупые вопросы задавать. Не особо разбирался в системе, настроил окружение под себя, подобрал нужный софт и просто тупо пользуюсь... Забыл уже когда в последний раз ковырялся... Именно поэтому и пользуюсь... Не красноглазил никогда, интерес если и возникал, то только чисто утилитарный, типа как настроить такой-то пакет... Где взять дрова для Yota wimax... Как правило все можно нарыть и не задавая ваще ни каких вопросов.

[Sam Stone]

Нормально. Написано же от кого сообщение - крон работает.

[kabukki]

Понятно! Спасибо! Я вот в первые в этот лог заглянул, не понял что к чему... Теперь знаю.
А вот этот кусок тогда что означает:
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/use_http_proxy
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/host
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/port

Я никаких proxy не настраивал!

[Meo]

Просто у тя гдето стоит галка на прокси "использовать настройки системы", вот оно и проверяет, а не указан ли у тебя прокси и не заюзать ли его... Не обращай внимания...

[Sam Stone]

Это синаптик полез за обновлениями и, соответственно, проверил, не надо ли ходить через прокси. Хотя явно на него и не указано, но как раз в это время (с 7.30 до 8.00) у меня запрашивается список пакетов.

[kabukki]

Ага, понятно! Вот ведь пень пнем... Поглядел в лог, увидел что там че-то делается без меня, и, не зная ни фига, заработал жесткий параноидальный крис...  Спасибо всем кто откликнулся!

[wl]

Понятно! Спасибо! Я вот в первые в этот лог заглянул, не понял что к чему... Теперь знаю.
А вот этот кусок тогда что означает:
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/use_http_proxy
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/host
Jul 21 07:58:57 demon-laptop sudo:     root : TTY=unknown ; PWD=/ ; USER=demon ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/port

Я никаких proxy не настраивал!

Надо знать и любить английского языка!
Там же ясно сказано - --get, т.е. получить.

[kabukki]

--get это я понял, только во че, главное кто... Тут вот ступор получился. Вот когда пишу apt-get update, все понятно, получаю список доступных на момент написания команды пакетов во всем, что я наприкручивал... А тут... Я ж говорил вроде, у меня пробелы в образовании.