Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am quite fresh with Linux as a whole, so this may be a silly question - but I would still like to know the answer

This morning when I look at my /var/log/auth.log (which I've been told to make a habit) I notice that once an hour it has logged an event that looks like this:

     May 13 20:17:01 Ubuntu-Server-1401-VM CRON[2280]: pam_unix(cron:session): session opened for user root by (uid=0)
     May 13 20:17:01 Ubuntu-Server-1401-VM CRON[2280]: session closed for user root

It has then proceeded to happen every hour at x:17:01 until I opened the log. An SSH connection to this server has been kept alive during this time (where the log entires occured). My best guess is that every hour my SSH client has looked to see whether or not it could obtain root access as a way to verify the connection to the SSH connection to the server - but I would like to be on the safe side. Does anyone know what this is?

share|improve this question
up vote 17 down vote accepted

Assuming you have not changed anything from the default cron setup, this is your /etc/crontab running. On my Ubuntu 10.04.3 LTS server, its contents include:

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly

So, cron wakes up every hour and runs any scrips located in /etc/cron.hourly. You probably don't have any which is why it doesn't do anything. It simply runs a root session which executes run-parts and then closes the session again.

share|improve this answer
Thank you, that clears things up! – Terje Gundersen May 14 '14 at 2:00
got it disabled, must just a waste.... – Копать_Шо_я_нашел Dec 18 '14 at 21:39

These log entries were written by the PAM libraries when the crond daemon ran tasks in the background. crond runs jobs on a schedule, on behalf of the system and the users on the system.

Every user has their own crontab configuration file, which can be edited with the crontab -e command. The system administrator can also configure jobs via a plethora of /etc/ files and directories; /etc/cron.d/ provides an easy place for services to drop their own configurations, and /etc/crontab drives the hourly, daily, and weekly directories, as well as runs whatever the administrator may choose to run.

crond will change users to the correct user (either specified in the /etc/crontab file and the /etc/cron.d/ directory, or from the user-supplied crontab files) before running the jobs; it uses the PAM system to change users.

PAM provides a single place to configure different ways to authenticate and authorize users and provide session setup, as well as provide a way to change passwords (or other authentication tokens). Every service that uses PAM has a configuration file in /etc/pam.d/ that describes which PAM modules to use when 'logging in' a user.

My /etc/pam.d/cron file looks like this:

# The PAM configuration file for the cron daemon

@include common-auth

# Read environment variables from pam_env's default files, /etc/environment
# and /etc/security/pam_env.conf.
session       required

# In addition, read system locale information
session       required envfile=/etc/default/locale

@include common-account
@include common-session-noninteractive 

# Sets up user limits, please define limits for cron tasks
# through /etc/security/limits.conf
session    required

This ensures limits that are configured for users are applied to users' tasks when they run them via cron. If you wanted to change those limits per-service, you could configure in this file with your own conf=/etc/security/cron-limits.conf and apply different limits than ssh logins (/etc/pam.d/sshd) or console logins (/etc/pam.d/login).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.