why normal user can start cron daemon?

[Michael_33]

Hi All,

When I do ps -ef|grep cron,the output is

root 996 1 May 06 /usr/sbin/cron
ypcoe 29916 996 ? /usr/sbin/cron
ypcoe 29956 996 ? /usr/sbin/cron
ypcoe 29978 996 ? /usr/sbin/cron

and I can not kill them.

any idea?

[Stefan Farrelly]

As root do;

/sbin/init.d/cron stop

Then if cron is still running manually kill the first cron - pid 996, then the others should die or else you may have to kill -9 them also.

[Michael_33]

thanks!

/sbin/init.d/cron stop works.
but others are still running, and even kill -9
can not.

I found there is some info in syslog.log

xntpd [926]:system event 1: system restart
.
.
.
Authentication failure for SNMP req from xxx


what does this mean?

[Michael_33]

can I stop xntpd?

[Steve Steel]

Hi

look at /usr/adm/cron/log

/usr/spool/cron/crontabs


The only way that cron could start another cron, is if it is in the root crontab file.
check your root crontab file for a cron entry.
If you don't find one, check your other crontab files for the "cron" entry.
As root try
grep cron /var/spool/cron/crontabs/*


I would not stop xntpd since this is to do with system time . see man xntpd



Steve Steel

[Peter Kloetgen]

Hi Michael,

try to use top- command to check out if you have zombie- processes on your system. If you use ps command to find the cron processes, do the following, find out the parent process for your cron processes, using the PPID. This shows you which process started the children processes. Try to kill these parent processes also.

Allways stay on the bright side of life!

Peter

[T G Manikandan]

check for this directory permissions.

/var/adm/cron

I have the permission of the files in that directory

prw------- 1 root root 0 Apr 9 10:02 FIFO
-rw-r--r-- 1 root root 28780 May 23 11:01 OLDlog
-r--r--r-- 1 bin bin 18 Nov 7 1997 at.allow
-r--r--r-- 1 bin bin 14 Nov 7 1997 cron.allow
-rw-r--r-- 1 root root 135609 May 27 12:45 log
-r--r--r-- 1 bin bin 17 Nov 7 1997 queuedefs

Thanks

[Michael_33]

thanks, but still the same.

any idea?

[Michael_33]

do I need some patch?

[Michael Tully]

Hi,

It looks as though other users are allowed to
have cron access and run jobs through this.
Have a look in /var/adm/cron/cron.allow
If the user is listed they are allowed to
run cron jobs. Is this user an application
user or normal user? If it is a normal user,
do they really need this access?
What output do you have now for cron if
you lookup the processes?

# ps -ef | grep cron