Ich habe etwas in auth.log gefunden:
May 9 12:39:01 nextcloudpi CRON[3225]: pam_unix(cron:session): session opened for user root by (uid=0)
May 9 12:39:01 nextcloudpi CRON[3225]: pam_unix(cron:session): session closed for user root
May 9 12:40:00 nextcloudpi sudo: pam_unix(sudo:session): session closed for user root
May 9 12:40:01 nextcloudpi CRON[3268]: pam_unix(cron:session): session opened for user root by (uid=0)
May 9 12:40:01 nextcloudpi CRON[3268]: pam_unix(cron:session): session closed for user root
May 9 12:40:22 nextcloudpi sudo: www-data : TTY=unknown ; PWD=/var/www/ncp-web ; USER=root ; COMMAND=/home/www/ncp-backup-launcher.sh bkp /media/USBdrive1/ncp-backups/nextcloud-bkp_20190324_1553445372.tar
May 9 12:40:22 nextcloudpi sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
May 9 12:40:38 nextcloudpi sudo: ge : TTY=pts/0 ; PWD=/home/ge ; USER=root ; COMMAND=/usr/bin/mc
May 9 12:40:38 nextcloudpi sudo: pam_unix(sudo:session): session opened for user root by ge(uid=0)
May 9 12:44:01 nextcloudpi sshd[3501]: Connection from 192.168.178.100 port 56108 on 192.168.178.49 port 22
May 9 12:44:11 nextcloudpi sshd[3501]: Accepted password for ge from 192.168.178.100 port 56108 ssh2
May 9 12:44:11 nextcloudpi sshd[3501]: pam_unix(sshd:session): session opened for user ge by (uid=0)
May 9 12:44:11 nextcloudpi systemd-logind[641]: New session 17 of user ge.
May 9 12:44:12 nextcloudpi sshd[3501]: User child is on pid 3609
May 9 12:44:12 nextcloudpi sshd[3609]: Starting session: shell for ge from 192.168.178.100 port 56108 id 0
May 9 12:45:01 nextcloudpi CRON[3620]: pam_unix(cron:session): session opened for user www-data by (uid=0)
May 9 12:45:01 nextcloudpi CRON[3619]: pam_unix(cron:session): session opened for user root by (uid=0)
May 9 12:45:01 nextcloudpi CRON[3618]: pam_unix(cron:session): session opened for user root by (uid=0)
May 9 12:45:01 nextcloudpi CRON[3619]: pam_unix(cron:session): session closed for user root
May 9 12:45:01 nextcloudpi CRON[3618]: pam_unix(cron:session): session closed for user root
May 9 12:45:02 nextcloudpi CRON[3620]: pam_unix(cron:session): session closed for user www-data
Wenn ich das nextcoudpi - web-Panel aufrufe, so kann ich mich anmelden. Ich kann gedoch keinen Befehl ausfĂŒhren und meine sdb blinkt.
Das Blinken scheint von dem o.g. Befehl zu kommen. Die HD ist mit einem backup beschÀftigt.
Wie kann ich diesen Befehl stoppen? Keine Ahnung, woher er stammt!