FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > CentOS > CentOS

 
 
LinkBack Thread Tools
 
Old 07-20-2008, 08:55 AM
Anne Wilson
 
Default crontab for nobody

Every day I see this in chkrootkit's log -

Checking `crontab'... Warning: crontab for nobody found, possible
Lupper.Worm... not infected

I know I met this once before, but I can't remember whether there is any cure
for it. It doesn't seem possible to remove nobody in kcron, and there are no
tasks set. What could/should I do about it?

Anne
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 01:05 PM
"Jim Perrin"
 
Default crontab for nobody

On Sun, Jul 20, 2008 at 4:55 AM, Anne Wilson <cannewilson@googlemail.com> wrote:
> Every day I see this in chkrootkit's log -
>
> Checking `crontab'... Warning: crontab for nobody found, possible
> Lupper.Worm... not infected
>
> I know I met this once before, but I can't remember whether there is any cure
> for it. It doesn't seem possible to remove nobody in kcron, and there are no
> tasks set. What could/should I do about it?


What does 'crontab -u nobody -l' show ?


--
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 03:17 PM
Anne Wilson
 
Default crontab for nobody

On Sunday 20 July 2008 14:05:45 Jim Perrin wrote:
> On Sun, Jul 20, 2008 at 4:55 AM, Anne Wilson <cannewilson@googlemail.com>
wrote:
> > Every day I see this in chkrootkit's log -
> >
> > Checking `crontab'... Warning: crontab for nobody found, possible
> > Lupper.Worm... not infected
> >
> > I know I met this once before, but I can't remember whether there is any
> > cure for it. It doesn't seem possible to remove nobody in kcron, and
> > there are no tasks set. What could/should I do about it?
>
> What does 'crontab -u nobody -l' show ?

Nothing at all - it just returns to the prompt.

Anne
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 03:24 PM
"Robert - elists"
 
Default crontab for nobody

> > What does 'crontab -u nobody -l' show ?
>
> Nothing at all - it just returns to the prompt.
>
> Anne

Anne,

It should say "no crontab for nobody" or show the crontab

Eh?

- rh

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 03:50 PM
Anne Wilson
 
Default crontab for nobody

On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
> > > What does 'crontab -u nobody -l' show ?
> >
> > Nothing at all - it just returns to the prompt.
> >
> > Anne
>
> Anne,
>
> It should say "no crontab for nobody" or show the crontab
>
> Eh?
>
It doesn't do either

Anne

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 04:44 PM
Bill Campbell
 
Default crontab for nobody

On Sun, Jul 20, 2008, Anne Wilson wrote:
>On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
>> > > What does 'crontab -u nobody -l' show ?
>> >
>> > Nothing at all - it just returns to the prompt.
>> >
>> > Anne
>>
>> Anne,
>>
>> It should say "no crontab for nobody" or show the crontab
>>
>> Eh?
>>
>It doesn't do either

Does anything show up with ``find /var/spool/cron -type f'?

Bill
--
INTERNET: bill@celestial.com Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way
Voice: (206) 236-1676 Mercer Island, WA 98040-0820
Fax: (206) 232-9186

Marijuana will be legal some day, because the many law students
who now smoke pot will someday become congressmen and legalize
it in order to protect themselves. -- Lenny Bruce
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 05:04 PM
Chris Clonch
 
Default crontab for nobody

On Sunday 20 July 2008 11:50:21 Anne Wilson wrote:
> On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
> > > > What does 'crontab -u nobody -l' show ?
> > >
> > > Nothing at all - it just returns to the prompt.
> > >
> > > Anne
> >
> > Anne,
> >
> > It should say "no crontab for nobody" or show the crontab
> >
> > Eh?
>
> It doesn't do either
>
> Anne

Sounds like there is an empty crontab for nobody. Should be able to verify
this by 'ls -l /var/spool/cron/crontabs/nobody'. What if you try to remove
it by running 'crontab -l nobody -r'?

-Chris
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 06:18 PM
Anne Wilson
 
Default crontab for nobody

On Sunday 20 July 2008 17:44:23 Bill Campbell wrote:
> On Sun, Jul 20, 2008, Anne Wilson wrote:
> >On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
> >> > > What does 'crontab -u nobody -l' show ?
> >> >
> >> > Nothing at all - it just returns to the prompt.
> >> >
> >> > Anne
> >>
> >> Anne,
> >>
> >> It should say "no crontab for nobody" or show the crontab
> >>
> >> Eh?
> >
> >It doesn't do either
>
> Does anything show up with ``find /var/spool/cron -type f'?
>
/var/spool/cron/apache
/var/spool/cron/rpc
/var/spool/cron/nobody
/var/spool/cron/ftp
/var/spool/cron/hsqldb
/var/spool/cron/adm
/var/spool/cron/bin
/var/spool/cron/shutdown
/var/spool/cron/rpm
/var/spool/cron/gillian
/var/spool/cron/sync
/var/spool/cron/xfs
/var/spool/cron/sabayon
/var/spool/cron/news
/var/spool/cron/avahi
/var/spool/cron/gdm
/var/spool/cron/halt
/var/spool/cron/andy
/var/spool/cron/haldaemon
/var/spool/cron/anne
/var/spool/cron/dovecot
/var/spool/cron/mailnull
/var/spool/cron/nfsnobody
/var/spool/cron/clamav
/var/spool/cron/gopher
/var/spool/cron/operator
/var/spool/cron/beaglidx
/var/spool/cron/postgres
/var/spool/cron/root
/var/spool/cron/games
/var/spool/cron/mail
/var/spool/cron/sshd
/var/spool/cron/rpcuser
/var/spool/cron/daemon
/var/spool/cron/nscd
/var/spool/cron/david
/var/spool/cron/groupware
/var/spool/cron/pcap
/var/spool/cron/smmsp
/var/spool/cron/postfix
/var/spool/cron/ntp
/var/spool/cron/uucp
/var/spool/cron/lp
/var/spool/cron/dbus
/var/spool/cron/vcsa

Anne

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 06:20 PM
Anne Wilson
 
Default crontab for nobody

On Sunday 20 July 2008 18:04:10 Chris Clonch wrote:
> On Sunday 20 July 2008 11:50:21 Anne Wilson wrote:
> > On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
> > > > > What does 'crontab -u nobody -l' show ?
> > > >
> > > > Nothing at all - it just returns to the prompt.
> > > >
> > > > Anne
> > >
> > > Anne,
> > >
> > > It should say "no crontab for nobody" or show the crontab
> > >
> > > Eh?
> >
> > It doesn't do either
> >
> > Anne
>
> Sounds like there is an empty crontab for nobody. Should be able to verify
> this by 'ls -l /var/spool/cron/crontabs/nobody'. What if you try to remove
> it by running 'crontab -l nobody -r'?
>
I can't get that to run, Chris.

crontab: usage error: only one operation permitted

Anne
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 
Old 07-20-2008, 07:03 PM
John Horne
 
Default crontab for nobody

On Sun, 2008-07-20 at 19:20 +0100, Anne Wilson wrote:
> On Sunday 20 July 2008 18:04:10 Chris Clonch wrote:
> > On Sunday 20 July 2008 11:50:21 Anne Wilson wrote:
> > > On Sunday 20 July 2008 16:24:31 Robert - elists wrote:
> > > > > > What does 'crontab -u nobody -l' show ?
> > > > >
> > > > > Nothing at all - it just returns to the prompt.
> > > > >
> > > > > Anne
> > > >
> > > > Anne,
> > > >
> > > > It should say "no crontab for nobody" or show the crontab
> > > >
> > > > Eh?
> > >
> > > It doesn't do either
> > >
> > > Anne
> >
> > Sounds like there is an empty crontab for nobody. Should be able to verify
> > this by 'ls -l /var/spool/cron/crontabs/nobody'. What if you try to remove
> > it by running 'crontab -l nobody -r'?
> >
> I can't get that to run, Chris.
>
> crontab: usage error: only one operation permitted
>
I think what was meant was:

ls -l /var/spool/cron/nobody

to see what the size etc of the crontab was for nobody,

then

crontab -u nobody -r


to remove it if it was empty.



John.

--
---------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287
E-mail: John.Horne@plymouth.ac.uk Fax: +44 (0)1752 587001
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
 

Thread Tools




All times are GMT. The time now is 02:45 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org