CRON Appears to Start Itself!
Background:
The system is an HP 715 running under HP-UX 10.20. The CRON in question is run via an account created specially for this purpose. In other words, I don't run, or have access to, it under root.
Several times now, I have found crontabs running that I had disabled via crontab -r and verified were down with crontab -l. This is odd, to say the least.
Question:
Is there some kind of bug/glitch in the OS that would cause/allow this to happen, or should I start suspecting that someone is hacking in for a bit of fun?
The system is an HP 715 running under HP-UX 10.20. The CRON in question is run via an account created specially for this purpose. In other words, I don't run, or have access to, it under root.
Several times now, I have found crontabs running that I had disabled via crontab -r and verified were down with crontab -l. This is odd, to say the least.
Question:
Is there some kind of bug/glitch in the OS that would cause/allow this to happen, or should I start suspecting that someone is hacking in for a bit of fun?
Confirm if other accounts have no similiar cron running?
If you suspect that there are "hackers" in, check on the modification date of the files, sulog files,etc to see if there is any unexpected intruders.
If you suspect that there are "hackers" in, check on the modification date of the files, sulog files,etc to see if there is any unexpected intruders.
ASKER
Other accounts do have access to CRON, but not the particular crontab in question.
The modification date of the crontab is as it should be.
The modification date of the crontab is as it should be.
did you check the file also for 'latest access and creation' time?
check with "ls -lc", "ls -lu', and normal "ls -l".
If you delete the crontab file, then you can verify when the file was last read/accessed/created-modi
This way you can see of the file has been restored from backup, recreated, and at which time.
How often is the file being 're-created'? Does this occur every day/week/months?
check with "ls -lc", "ls -lu', and normal "ls -l".
If you delete the crontab file, then you can verify when the file was last read/accessed/created-modi
This way you can see of the file has been restored from backup, recreated, and at which time.
How often is the file being 're-created'? Does this occur every day/week/months?
ASKER
If by "created" you mean activated with the crontab <filename> command, then this is done once every several months. I'm not seeing from ls commands where the crontab was accessed on the days that I found it running after having deactivated it, so I guess this rules out hacking.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
When I issue a crontab -r command, this does not remove it from the system, but rather stops it from being executed.
You must verify the crontab files in the crontab directory. Check for the modification time of this file (and directory).
Also take a look a possible schedules 'at' jobs.