ssh - suspicious logins root - Ask Ubuntu

i have noticed suspicious logins root account on server created new admin account , assigned root permissions account , disabled root account. had @ /var/log/auth.log file , can see there no more logins suspicious ip anymore showing:

oct 25 06:06:01 serverhostname cron[10452]: pam_unix(cron:session):   session opened user root (uid=0) oct 25 06:06:01 serverhostname cron[10452]: pam_unix(cron:session): session closed user root 

are these scheduled cron jobs? can these ignored?

the session entry due cron job running root. being spawned @ 06:06.

check relevant cron entries root , find out being run @ time exactly.

possible places at:

• /etc/crontab
• /etc/cron.d/*
• /etc/cron.hourly/*
• root's crontab: crontab -e root

if anacron not active:

• /etc/cron.daily/*
• /etc/cron.weekly/*
• /etc/cron.monthly/*

---

just add, if system compromised before, stop using it, take backup (if needed), setup os again. later can analyze backed contents dig further regarding intrusion.