Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a server that's been running for years now and there are no cron jobs set up. I have not logged in or changed anything in months. Suddenly I started receiving emails that look like this, about once per hour, but not always for some reason:

To: root@mydomain.com
Subject: Cron <root@mydomain.com> [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete

PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/cli/conf.d/mhash.ini on line 1 in Unknown on line 0
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib/php5/20090626/mhash.so' - /usr/lib/php5/20090626/mhash.so: cannot open shared object file: No such file or directory in Unknown on line 0

I have no idea what this is talking about. It's bizarre because I did not change anything.

I checked to see if ther eare any cron jobs by running this command while logged in as root:

for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

There were none:

no crontab for root
no crontab for daemon
no crontab for bin
no crontab for sys
:
:
etc, for all users

What is going on? How do I stop this? And furthermore, I'm a little concerned that someone broke into the server and changed something, because I didn't touch a single thing.

Any ideas?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You are assuming cron jobs exist in standard crontabs. Do this:

ls -lR /etc/cron*

Oh, and no... that does NOT mean that you've been hacked!

share|improve this answer
    
Users can also create their own cron jobs. Check out /var/cron or /var/spool/cron/crontabs. –  Kasius Oct 2 '12 at 19:52
    
Yes, but he already checked the individual users' crontabs (those are what are listed in the directories you listed.) –  UtahJarhead Oct 2 '12 at 20:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.