0

I tend to be on the paranoid side, and for some time there are messages in my log file that tend to get me going close to the edge of sanity. Could someone explain the following in my auth.log file that indicates a user named dnsmasq changed their password in my computer. I realize that this might be a dumb question, but this kind of thing has been going on for several years and every time I see something like it, I tend to become anxious and afraid that someone is spying on me. Can anyone lay my fears to rest?

discover-healing-honey sudo: pam_unix(sudo:session): session closed for user root
May 15 16:51:20 discover-healing-honey polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session2 (system bus name :1.55 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
May 15 16:55:39 discover-healing-honey useradd[16831]: new user: name=dnsmasq, UID=115, GID=65534, home=/var/lib/misc, shell=/bin/false
May 15 16:55:39 discover-healing-honey usermod[16836]: change user 'dnsmasq' password
May 15 16:55:39 discover-healing-honey chage[16841]: changed password expiry for dnsmasq
May 15 16:55:39 discover-healing-honey chfn[16844]: changed user 'dnsmasq' information
May 15 16:56:02 discover-healing-honey polkit-agent-helper-1[16995]: pam_ecryptfs: pam_sm_authenticate: /home/bee-hives-rule is already mounted
May 15 16:56:02 discover-healing-honey polkitd(authority=local): Operator of unix-session:/org/freedesktop/ConsoleKit/Session2 successfully authenticated as unix-user:bee-hives-rule to gain TEMPORARY authorization for action com.ubuntu.softwareproperties.applychanges for unix-process:7420:308018 [/usr/bin/python3 /usr/bin/software-properties-gtk] (owned by unix-user:bee-hives-rule)
May 15 16:56:41 discover-healing-honey sg[21950]: user 'root' (login '???' on pts/1) switched to group 'mlocate'
May 15 16:56:41 discover-healing-honey sg[21950]: user 'root' (login '???' on pts/1) returned to group 'root'
May 15 17:02:49 discover-healing-honey lightdm: pam_unix(lightdm-greeter:session): session opened for user lightdm by (uid=0)
May 15 17:02:49 discover-healing-honey lightdm: pam_ck_connector(lightdm-greeter:session): nox11 mode, ignoring PAM_TTY :0
May 15 17:02:53 discover-healing-honey dbus[1326]: [system] Rejected send message, 7 matched rules; type="method_return", sender=":1.19" (uid=0 pid=1713 comm="/usr/sbin/dnsmasq --no-resolv --keep-in-foreground") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.6" (uid=0 pid=1546 comm="NetworkManager ")
May 15 17:02:56 discover-healing-honey lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "bee-hives-rule"
May 15 17:02:56 discover-healing-honey lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "bee-hives-rule"
Improve this question

1 Answer 1

Reset to default
5

Nothing there looks out of the ordinary. It's a log of all authentication and authorization (two very different things) attempts.

dnsmasq is a local DNS cache.

lightdm is your "Display Manager" the thing that prompts for your username and passsword before you login (inside X).

Nothing there suggests spying or key logging or even remote login attempts. Basically it's a bunch of system processes running as system processes and their requests for authorization being logged.

Improve this answer
2
  • Thanks, the reason I ask is because I DO have some intruders visit. When I first went over to full encryption, I named my computer "This machine fights fascists". Some months later when I was helping my wife get her Windows machine back in order, someone had changed the name of the disk to "tHIS dISK fIGHTS fASCISTS". So I've seen unusual things happen here, that's why I tend to be on guard.
    – user54003
    May 15, 2013 at 21:31
  • 2
    While I like the name for your machine, you should avoid this kind of names for things that are going to be exposed to the network, like the hostname. The less information you give about who you are or how you think, the better. I tend to be paranoid too, and I like to name my computer after silly things, lets say... names of planets of sci-fiction movies.
    – animaletdesequia
    Jan 9, 2014 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .