Hidden Cron Jobs

[phoenixisp]

My CentOS 4/PSA 8.1.1 server has been attacked. I think I have it tightened up except that when I check my cron log there are 2 entries that I can't find when I run crontab -e. The 2 are running every 1 minute. I have checked all files in cron.d, cron.daily, etc.

How do I remove these?

Thanks....

 

[faris]

check out /var/spool/cron

Each system user with a cron job has a file in here.

You should not manually edit these files - they are what you edit with crontab -e but at least you'll see which user has these hidden conjobs and can then edit them with crontab -u USER -e where USER is the particular crontab in question.

By default crontab -e edits the root user crontab (because you are root), so if it is under a different user you won't see it.

Faris.

 

[phoenixisp]

Thanks faris - that did the trick!