Var/log/secure shows many sessions

Distro Discussion & Help
1

Hello,

FreePBX Distro 10.13.66.x shows strange behavior in the /var/log/secure file.
Containing the next lines within every x-seconds:

Feb 1 14:31:24 localhost su: pam_unix(su:session): session opened for user asterisk by (uid=0)
Feb 1 14:31:24 localhost su: pam_unix(su:session): session closed for user asterisk
Feb 1 14:31:59 localhost su: pam_unix(su:session): session opened for user asterisk by (uid=0)
Feb 1 14:31:59 localhost su: pam_unix(su:session): session closed for user asterisk
Feb 1 14:32:34 localhost su: pam_unix(su:session): session opened for user asterisk by (uid=0)
Feb 1 14:32:34 localhost su: pam_unix(su:session): session closed for user asterisk
etc etc

What could cause this? It shows up in different installations.

2

I believe these entries are generated by the freepbx firewall/incrond, someone please feel free to correct me if I am wrong.

3

I believe they are generated by the cron jobs that are scheduled to run every minute. Most of the cron jobs are needed.

I have been testing making changes to the pam.d config file:

Adding the next line to the /etc/pam.d/su file should help. Though order matters so make sure you test where you put the line. I think it should be the top of the session lines.
session [success=1 default=ignore] pam_succeed_if.so service in su quiet uid = 0

to the