/var/log/secure user activity. also, httpd can not start without two users
- by user52869
hello,
i found some strange informations in /var/log/secure file:
Feb 10 02:02:04 server2364 usermod[30750]: unlock user `username1' password
Feb 10 02:02:04 server2364 usermod[30811]: lock user `username2' password
Feb 10 02:05:16 server2364 usermod[30992]: unlock user `username2' password
Feb 10 02:05:18 server2364 usermod[31114]: unlock user `username1' password
username1 and username2 are two usernames on system, that have no ability to login.
for every night in 02:02h results like that are in /var/log/secure file.
one more thing: files /etc/shadow, and /etc/shadow have timestamps 02:05h.
what can be cause for it?
next thing, if i remove those two accounts (username1 and username2), i can not start web server.
can you help me with some ideas, am i hacked?