Raspberry Pi root login

[r00igev@@r]

I wrote a script that tells me about root login and I notice that multiple Pi's has one every day at around 7:30am. It seems to be some type of schedule but I haven't yet diagnosed which one.

Any ideas?

 

[Leno]

Any logs to show detail/ip's ?

Not maybe cron running a job as root?

 

[r00igev@@r]

Any logs to show detail/ip's ?

Not maybe cron running a job as root?

I was thinking that and looked at cron and nothing. I'll look at the systemd timers.

 

[r00igev@@r]

I found this with sudo systemctl list-timers --all

I have a script in /etc/profile.d/ that notifies me about root escalation, so now I know it actually works.

NEXT                         LEFT        LAST                         PASSED       UNIT                         ACTIVATES
Wed 2023-11-01 11:05:50 SAST 6min left   n/a                          n/a          systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Thu 2023-11-02 00:00:00 SAST 13h left    Wed 2023-11-01 00:01:43 SAST 10h ago      logrotate.timer              logrotate.service
Thu 2023-11-02 00:00:00 SAST 13h left    Wed 2023-11-01 00:01:43 SAST 10h ago      man-db.timer                 man-db.service
Thu 2023-11-02 03:48:09 SAST 16h left    Wed 2023-11-01 07:11:30 SAST 3h 47min ago apt-daily.timer              apt-daily.service
Thu 2023-11-02 06:21:05 SAST 19h left    Wed 2023-11-01 06:37:04 SAST 4h 21min ago apt-daily-upgrade.timer      apt-daily-upgrade.service
Sun 2023-11-05 03:10:57 SAST 3 days left Sun 2023-10-29 03:10:54 SAST 3 days ago   e2scrub_all.timer            e2scrub_all.service
Mon 2023-11-06 00:48:38 SAST 4 days left Mon 2023-10-30 01:31:34 SAST 2 days ago   fstrim.timer                 fstrim.service

 

[Leno]

Wondered about cron as anacron's default time used to be 7:30

Not sure if Raspbian uses anacron