sshd killing every minute

[Sheldon]

Jan 25 19:03:01 aquila crond(pam_unix)[3981]: session opened for user root by (uid=0)
Jan 25 19:03:01 aquila crond(pam_unix)[3981]: session closed for user root
Jan 25 19:04:01 aquila crond(pam_unix)[3984]: session opened for user root by (uid=0)
Jan 25 19:04:01 aquila crond(pam_unix)[3985]: session opened for user root by (uid=0)
Jan 25 19:04:01 aquila crond(pam_unix)[3985]: session closed for user root
Jan 25 19:04:01 aquila crond(pam_unix)[3984]: session closed for user root
Jan 25 19:05:01 aquila crond(pam_unix)[4009]: session opened for user root by (uid=0)
Jan 25 19:05:01 aquila crond(pam_unix)[4009]: session closed for user root
Jan 25 19:06:01 aquila crond(pam_unix)[4011]: session opened for user root by (uid=0)
Jan 25 19:06:01 aquila crond(pam_unix)[4011]: session closed for user root
Jan 25 19:07:01 aquila crond(pam_unix)[4013]: session opened for user root by (uid=0)
Jan 25 19:07:01 aquila crond(pam_unix)[4013]: session closed for user root
Jan 25 19:08:01 aquila crond(pam_unix)[4015]: session opened for user root by (uid=0)
Jan 25 19:08:01 aquila crond(pam_unix)[4016]: session opened for user root by (uid=0)
Jan 25 19:08:01 aquila crond(pam_unix)[4016]: session closed for user root
Jan 25 19:08:01 aquila crond(pam_unix)[4015]: session closed for user root
Jan 25 19:09:01 aquila crond(pam_unix)[4044]: session opened for user root by (uid=0)
Jan 25 19:09:01 aquila crond(pam_unix)[4044]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4046]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4047]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4051]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4054]: session opened for user root by (uid=0)
Jan 25 19:10:01 aquila crond(pam_unix)[4047]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4054]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4046]: session closed for user root
Jan 25 19:10:01 aquila crond(pam_unix)[4051]: session closed for user root
Jan 25 19:11:01 aquila crond(pam_unix)[4284]: session opened for user root by (uid=0)
Jan 25 19:11:01 aquila crond(pam_unix)[4284]: session closed for user root

Whats wrong with this?

[jlasman]

Can you tell us what you're doing, the resuts you're expecting, and the results you're getting?

That would be much more helpful than just showing us log entries?

Thanks.

Jeff

[Sheldon]

Its just that im not loggin in and logging out every minute. Im logged in and yet its saying its openning a new session every minute.

[jlasman]

Have you tried tailing your /var/log/secure file for a a minute or two to see whether it's showing login attempts?

Jeff

[Sheldon]

I know it shouldnt be because its on a different port.

[root@aquila ~]# tail /var/log/secure
Jan 25 10:17:09 aquila sshd[4006]: error: Bind to port 8080 on 0.0.0.0 failed: Address already in use.
Jan 25 10:17:40 aquila sshd[4597]: Accepted password for root from ::ffff:192.197.62.99 port 42198 ssh2
Jan 25 13:44:16 aquila sshd[23216]: Accepted password for root from ::ffff:192.197.62.99 port 16650 ssh2
Jan 25 15:57:04 aquila sshd[28515]: Accepted publickey for root from ::ffff:24.244.241.217 port 62508 ssh2
Jan 25 17:57:23 aquila sshd[763]: Accepted publickey for root from ::ffff:24.244.241.217 port 63623 ssh2
Jan 25 19:11:55 aquila sshd[4288]: Accepted publickey for root from ::ffff:24.244.241.217 port 60261 ssh2
Jan 25 19:13:29 aquila sshd[4006]: Received signal 15; terminating.
Jan 25 19:13:30 aquila sshd[4464]: Server listening on :: port 8080.
Jan 25 19:13:30 aquila sshd[4464]: error: Bind to port 8080 on 0.0.0.0 failed: Address already in use.
Jan 25 19:42:13 aquila sshd[5345]: Accepted publickey for root from ::ffff:24.244.241.217 port 60439 ssh2

[jlasman]

I don't have an answer for you; you should probably post on an OS-specific users group.

Jeff

[libit]

In your first post, it looks like crond is logging something every minute, not sshd.
Check if you have a file named /var/spool/cron/root or any files in /etc/cron.d. They are causing the log messages.