質問: 「rootによるユーザーのsuの成功」-/var/log/auth.logの疑わしいエントリ? redditのこの投稿 ログを確認しました。そのとき、私は次の2日間の非次の日に登場するエントリを発見しました。 「user」は私のユーザーアカウントです。aug 4 22:50:37 ubuntusystem sudo: pam_unix(sudo:session): session opened for user root by user(uid=1000) aug 4 22:50:39 ubuntusystem sudo: pam_unix(sudo:session): session closed for user root aug 4 22:51:16 ubuntusystem su[10710]: successful su for user by root aug 4 22:51:16 ubuntusystem su[10710]: + ??? root:user aug 4 22:51:16 ubuntusystem su[10710]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10710]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10720]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10720]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10720]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10720]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10735]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10735]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10735]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10735]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10763]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10763]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10763]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10763]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10773]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10773]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10773]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10773]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10788]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10788]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10788]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10788]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10801]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10801]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10801]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10801]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10814]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10814]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10814]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10814]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10829]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10829]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10829]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10829]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10842]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10842]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10842]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10842]: pam_unix(su:session): session closed for user user aug 4 22:51:17 ubuntusystem su[10855]: successful su for user by root aug 4 22:51:17 ubuntusystem su[10855]: + ??? root:user aug 4 22:51:17 ubuntusystem su[10855]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 22:51:17 ubuntusystem su[10855]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11153]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11153]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11153]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11153]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11166]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11166]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11166]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11166]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11181]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11181]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11181]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11181]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11193]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11193]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11193]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11193]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11211]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11211]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11211]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11211]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11226]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11226]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11226]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11226]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11241]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11241]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11241]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11241]: pam_unix(su:session): session closed for user user aug 4 23:41:39 ubuntusystem su[11253]: successful su for user by root aug 4 23:41:39 ubuntusystem su[11253]: + ??? root:user aug 4 23:41:39 ubuntusystem su[11253]: pam_unix(su:session): session opened for user user by (uid=0) aug 4 23:41:39 ubuntusystem su[11253]: pam_unix(su:session): session closed for user user aug 4 23:42:18 ubuntusystem gnome-screensaver-dialog: gkr-pam: unlocked login keyring aug 4 23:42:33 ubuntusystem polkitd(authority=local): unregistered authentication agent for unix-session:/org/freedesktop/consolekit/session2 (system bus name :1.48, object path /org/gnome/policykit1/authenticationagent, locale en_us.utf-8) (disconnected from bus) aug 15 20:17:01 ubuntusystem cron[26579]: pam_unix(cron:session): session opened for user root by (uid=0) aug 15 20:17:01 ubuntusystem cron[26579]: pam_unix(cron:session): session closed for user root aug 15 21:15:15 ubuntusystem su[27098]: successful su for user by root aug 15 21:15:15 ubuntusystem su[27098]: + ??? root:user aug 15 21:15:15 ubuntusystem su[27098]: pam_unix(su:session): session opened for user user by (uid=0) aug 15 21:15:15 ubuntusystem su[27098]: pam_unix(su:session): session closed for user user aug 15 21:17:01 ubuntusystem cron[27141]: pam_unix(cron:session): session opened for user root by (uid=0) aug 15 21:17:01 ubuntusystem cron[27141]: pam_unix(cron:session): session closed for user root これらの反復とは別に、同様の出力が見つかった他の唯一の時間は、ゲストアカウントを試したときでした。aug 11 22:38:49 ubuntusystem lightdm: pam_unix(lightdm:session): session closed for user lightdm aug 11 22:38:49 ubuntusystem groupadd[2918]: group added to /etc/group: name=guest-4eflre, gid=125 aug 11 22:38:49 ubuntusystem groupadd[2918]: group added to /etc/gshadow: name=guest-4eflre aug 11 22:38:49 ubuntusystem groupadd[2918]: new group: name=guest-4eflre, gid=125 aug 11 22:38:50 ubuntusystem useradd[2922]: new user: name=guest-4eflre, uid=115, gid=125, home=/, shell=/bin/bash aug 11 22:38:50 ubuntusystem usermod[2927]: change user 'guest-4eflre' password aug 11 22:38:50 ubuntusystem chage[2932]: changed password expiry for guest-4eflre aug 11 22:38:50 ubuntusystem chfn[2935]: changed user 'guest-4eflre' information aug 11 22:38:50 ubuntusystem usermod[2943]: change user 'guest-4eflre' home from '/' to '/tmp/guest-4eflre' aug 11 22:38:50 ubuntusystem su[2948]: successful su for guest-4eflre by root aug 11 22:38:50 ubuntusystem su[2948]: + ??? root:guest-4eflre aug 11 22:38:50 ubuntusystem su[2948]: pam_unix(su:session): session opened for user guest-4eflre by (uid=0) aug 11 22:38:50 ubuntusystem su[2948]: pam_unix(su:session): session closed for user guest-4eflre aug 11 22:38:50 ubuntusystem lightdm: pam_unix(lightdm-autologin:session): session opened for user guest-4eflre by (uid=0) aug 11 22:38:50 ubuntusystem lightdm: pam_ck_connector(lightdm-autologin:session): nox11 mode, ignoring pam_tty :0 私がシステムをセットアップしたのはごく最近(8月4日)にのみ追加する必要があるかもしれません。この動作は正常ですか?すべてのsuコマンドで正確に何が起こっていますか?システムが危険にさらされるのではないかと心配する必要がありますか?事前に感謝します。
回答: これらは、sudoを実行したときのnotです。しかし、それらも問題ではありません。メッセージは言う:successful su for user by rootこれはログインするたびに発生します。実際のユーザーとしてログインするかゲストユーザーとしてログインするかにかかわらず、ログイン画面はrootとして実行されるため、ユーザーidを変更する必要がありますfromroottoログインプロセスの一部としての非rootユーザー。これはuserではなくrootになります。これはrootがuserになります。