Hi,
I have setup a new server and within a day I was getting brute force attacks.
I removed root access and I modified my iptables to keep the number of tries within a min to 8, but now I see these lines -

pam_unix(cron:session): session opened for user root by (uid=0)


Is this a normal line or something else?

Thanks for any help.

Nope, as it says "cron:session" it means that it is cron (scheduled) jobs that are running regulary.

Pretty normal.

Thanks for the reply -
I am using fail2ban now as well.

Thanks

crashed is right, it is just a cron job probably set your script or have you set a cron job?