topic Re: why normal user can start cron daemon? in Operating System - HP-UX

why normal user can start cron daemon?

Michael_33 — Mon, 27 May 2002 07:12:01 GMT

Hi All,

When I do ps -ef|grep cron,the output is

root 996 1 May 06 /usr/sbin/cron
ypcoe 29916 996 ? /usr/sbin/cron
ypcoe 29956 996 ? /usr/sbin/cron
ypcoe 29978 996 ? /usr/sbin/cron

and I can not kill them.

any idea?

Re: why normal user can start cron daemon?

Stefan Farrelly — Mon, 27 May 2002 07:30:14 GMT

As root do;

/sbin/init.d/cron stop

Then if cron is still running manually kill the first cron - pid 996, then the others should die or else you may have to kill -9 them also.

Re: why normal user can start cron daemon?

Michael_33 — Mon, 27 May 2002 07:39:18 GMT

thanks!

/sbin/init.d/cron stop works.
but others are still running, and even kill -9
can not.

I found there is some info in syslog.log

xntpd [926]:system event 1: system restart
.
.
.
Authentication failure for SNMP req from xxx

what does this mean?

Re: why normal user can start cron daemon?

Michael_33 — Mon, 27 May 2002 07:45:48 GMT

can I stop xntpd?

Re: why normal user can start cron daemon?

Steve Steel — Mon, 27 May 2002 08:07:15 GMT

Hi

look at /usr/adm/cron/log

/usr/spool/cron/crontabs

The only way that cron could start another cron, is if it is in the root crontab file.
check your root crontab file for a cron entry.
If you don't find one, check your other crontab files for the "cron" entry.
As root try
grep cron /var/spool/cron/crontabs/*

I would not stop xntpd since this is to do with system time . see man xntpd

Steve Steel

Re: why normal user can start cron daemon?

Peter Kloetgen — Mon, 27 May 2002 09:28:09 GMT

Hi Michael,

try to use top- command to check out if you have zombie- processes on your system. If you use ps command to find the cron processes, do the following, find out the parent process for your cron processes, using the PPID. This shows you which process started the children processes. Try to kill these parent processes also.

Allways stay on the bright side of life!

Peter

Re: why normal user can start cron daemon?

T G Manikandan — Mon, 27 May 2002 09:45:25 GMT

check for this directory permissions.

/var/adm/cron

I have the permission of the files in that directory

prw------- 1 root root 0 Apr 9 10:02 FIFO
-rw-r--r-- 1 root root 28780 May 23 11:01 OLDlog
-r--r--r-- 1 bin bin 18 Nov 7 1997 at.allow
-r--r--r-- 1 bin bin 14 Nov 7 1997 cron.allow
-rw-r--r-- 1 root root 135609 May 27 12:45 log
-r--r--r-- 1 bin bin 17 Nov 7 1997 queuedefs

Thanks

Re: why normal user can start cron daemon?

Michael_33 — Tue, 28 May 2002 00:00:50 GMT

thanks, but still the same.

any idea?

Re: why normal user can start cron daemon?

Michael_33 — Tue, 28 May 2002 00:27:49 GMT

do I need some patch?

Re: why normal user can start cron daemon?

Michael Tully — Tue, 28 May 2002 00:50:05 GMT

Hi,

It looks as though other users are allowed to
have cron access and run jobs through this.
Have a look in /var/adm/cron/cron.allow
If the user is listed they are allowed to
run cron jobs. Is this user an application
user or normal user? If it is a normal user,
do they really need this access?
What output do you have now for cron if
you lookup the processes?

# ps -ef | grep cron

Re: why normal user can start cron daemon?

Michael_33 — Tue, 28 May 2002 01:02:23 GMT

that user needs to run cron job.

I found there is some info in syslog.log

xntpd [926]:system event 1: system restart
.
.
.
Authentication failure for SNMP req from xxx

what does this mean?

Re: why normal user can start cron daemon?

Michael Tully — Tue, 28 May 2002 01:49:56 GMT

Hi,

You could well do with patching? What is your
current patch level? If you don't know here's
how and post the results.

# swlist -a revision

The two messages refer to two different things.
The first in relation to xntpd, seems that the
deamon has been restarted, or this is part of your standard system startup message. Can you confirm how long your system has been up? The second message relates to an authentication message from ip x.x.x.x for an snmp trap. This could be nothing but do you run anything like Network node manager or openview tools?