2

I was browsing my logs on papertail and I saw this.

Jun 03 03:26:01 /USR/SBIN/CRON:  (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )) 
    Jun 03 03:26:04 su:  Successful su for www-data by root 
    Jun 03 03:26:04 su:  + ??? root:www-data 
    Jun 03 03:26:04 su:  pam_unix(su:session): session opened for user www-data by (uid=0) 
    Jun 03 03:26:04 su:  pam_unix(su:session): session closed for user www-data 
    Jun 03 03:26:04 su:  Successful su for www-data by root 
    Jun 03 03:26:04 su:  + ??? root:www-data 
    Jun 03 03:26:04 su:  pam_unix(su:session): session opened for user www-data by (uid=0) 
    Jun 03 03:26:04 su:  pam_unix(su:session): session closed for user www-data 
    Jun 03 03:26:04 syslog-ng:  Configuration reload request received, reloading configuration; 
    Jun 03 03:26:04 syslog-ng:  EOF on control channel, closing connection; 
    Jun 03 03:26:05 syslog-ng:  Configuration reload request received, reloading configuration; 
    Jun 03 03:26:05 syslog-ng:  EOF on control channel, closing connection; 
    Jun 03 03:26:05 CRON:  pam_unix(cron:session): session closed for user root 
    Jun 03 03:39:01 CRON:  pam_unix(cron:session): session opened for user root by (uid=0)

Isn't it possible breakin attempt? Why is root logged as www-data and syslog-ng reload configuration?

Edit.

Files in /etc/cron.daily

apt aptitude bsdmainutils dpkg lighttpd logrotate man-db passwd

In lighttpd is 

#!/bin/sh
# Cleanup lighttpd compress cache

cache=/var/cache/lighttpd
if test -d "$cache/compress"; then
    su -s /bin/sh -c "find $cache/compress -type f -atime +30 -print0  | xargs -0 -r rm" www-data
fi
if test -d "$cache/uploads"; then
    su -s /bin/sh -c "find $cache/uploads -type f -atime +1 -print0 | xargs -0 -r rm" www-data
fi
Andrew Schulman
  • 8,561
  • 21
  • 31
  • 47
Jakub Doležal
  • 21
  • 3
  • 3
    I would say the answer is no. Noone is TRYING to. They are way past trying - if I read that right, they already own your machine (successfull su for www-data). – TomTom Jun 03 '15 at 12:35
  • 6
    There is always somebody trying to break into every computer on the internet. Your VPS is no exception, so yes somebody is trying to break in. But those entries don't look like an attempt to break in. They look like a cron job being executed by root and then switching to www-data in order to perform some operation with fewer privileges. – kasperd Jun 03 '15 at 12:35
  • 2
    @TomTom What makes you think this isn't a legitimate cron job? – kasperd Jun 03 '15 at 12:37
  • I have been hacked last month because I had weak password. But I have very strong password now (and reinstall VPS ). I added iptables rules to reject everyone except me. I think that no one hacked my VPS. – Jakub Doležal Jun 03 '15 at 12:55
  • 4
    @kuba If you want any useful answer, you will need to update your question with information about the contents of `/etc/cron.daily`. – kasperd Jun 03 '15 at 13:05
  • 1
    "Is someone trying to hack into my VPS?" The answer to this is yes, always. Maintaining a VPS involves preventing them from being successful at it - you can't stop the automated attempts that hit every IP on the internet regularly. – ceejayoz Jun 03 '15 at 13:25

1 Answers1

2

Yes, your VPS is always under attack. But no, that's not what this log entry shows.

This is legitimate activity. It's anacron, running the daily /etc/cron.daily/lighttpd job, as you saw. In the (corrected) lighttpd cron script, you can see that the script is running su www-data, and the log file shows root changing user to www-data.

Andrew Schulman
  • 8,561
  • 21
  • 31
  • 47