On Fri, 4 Nov 2005 23:17:25 +1100
Damien Miller wrote:

> On Fri, 04 Nov 2005 11:54:14 +0100
> Evert van de Waal wrote:
> > The aut.log file shows the following:
> > Nov 4 06:25:01 localhost su[5715]: + ??? root:nobody
> > Nov 4 06:25:01 localhost su[5715]: (pam_unix) session opened for user
> > nobody by
> > (uid=0)


oh, I misread. This is root su'ing to nobody and not the other way
round. It is probably not related to malicious activity at all.

-d

_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://www.mindrot.org/mailman/listi...enssh-unix-dev