Some cronjob is trying to chown -R with the old syntax and now I'm drowning in emails

Support
1

What type of hardware are you using: VPS bought online
What YunoHost version are you running: YunoHost 12.1.17.1 (stable)
How are you able to access your server: SSH
Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: I committed attempted migration

Describe your issue

Some cronjob is trying to chown -R root.admins /usr/share/ssowat using the old dot syntax and not the newer colon syntax, so it’s trying to rename all the files to a non-existent ‘root.admins’ user name vs what it presumably intends ‘root:admins’, I don’t know where to stop it, but the emails just keep piling up! Two emails every minute on the minute.

/usr/share/ssowat/* is already owned by root:admins all the way down.
I have checked crontab -l for root and gemlog
I have grepped -rin all of cron.d’s, /var/syslog, at and, indeed, all of /etc itself looking for something trying to enforce ownership. I can’t find it.
I can easily see it in syslog, but not what ran the command in the first place.

Share relevant logs or error messages

From: Cron Daemon root@gemlog.ca
To: root@gemlog.ca
Subject: Cron root@gemlog chown -R root.admins /usr/share/ssowat
Date: Sun, 7 Sep 2025 12:33:01 -0700 (PDT)
chown: warning: ‘.’ should be ‘:’: ‘root.admins’

https://paste.yunohost.org/raw/asiculukor

It’s a pair of these every minute.

"This is the mail system at host gemlog.ca.
I’m sorry to have to inform you that your message could not
be delivered to one or more recipients. It’s attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can
delete your own text from the attached returned message.
The mail system
admin@gemlog.ca (expanded from ): user unknown
Reporting-MTA: dns; gemlog.ca
X-Postfix-Queue-ID: A02F8200F3D
X-Postfix-Sender: rfc822; root@gemlog.ca
Arrival-Date: Sun, 7 Sep 2025 12:33:01 -0700 (PDT)
Final-Recipient: rfc822; admin@gemlog.ca
Original-Recipient: rfc822;root@gemlog.ca
Action: failed Status: 5.1.1
Diagnostic-Code: x-unix; user unknown

Cron root@gemlog chown -R root.admins /usr/share/ssowat

From: Cron Daemon root@gemlog.ca
To: root@gemlog.ca
Date: 9/7/25 12:33 PM
chown: warning: ‘.’ should be ‘:’: ‘root.admins’

I have done all updates. I have restarted the server. I am unable to create aliases for admin, root or postmaster, even though I have admin privs. I had to delete those on advice to get step 34 of migration to proceed. I am very screwed right now. I can’t do w/o that email. For now, I have set a filter in my email client to move those mails to trash. 120 emails/hour.

2

Cron jobs can be found with ls /etc/cron.*

3

I thought I’d read through all those and also the at daemon and var/spool/cron
I’ll grep -rin them all for ‘word’ next to be sure I didn’t miss any - I simply cp’d all the dirs to a tmp dir:

root@gemlog 07-1723 tmp>grep -rin chown greptmp/
root@gemlog 07-1723 tmp>grep -rin perm greptmp/
root@gemlog 07-1724 tmp>grep -rin perms greptmp/
root@gemlog 07-1724 tmp>grep -rin own greptmp/

test for known string existing:
root@gemlog 07-1724 tmp>grep -rin time greptmp/

image
image984×446 115 KB

edit: grep -rin chown log/
in /var. must read now.
got it.
edit2: rats. Doesn’t tell me what ran it though.

log/syslog.1:99372:2025-09-03T00:51:01.699869-07:00 gemlog CRON[59726]: (root) CMD (chown -R ro
ot.admins /usr/share/ssowat)
log/syslog.1:99397:2025-09-03T00:52:01.721220-07:00 gemlog CRON[59739]: (root) CMD (chown -R ro
ot.admins /usr/share/ssowat)
log/syslog.1:99426:2025-09-03T00:53:01.736762-07:00 gemlog CRON[597

5

I have absolutely no idea why that cron would even exist in the first place … I can’t even think of a reason to have this as a cron job …

But yeah anyway I suppose you can try sudo grep -nr 'root.admins' /etc/cron* … and maybe sudo grep -nr 'root.admins' /root/

6

I had -rin grepped all I noted, but not root’s home dir. Nothing in there either. Thanks though.

7

Alternatively I suppose you could try to look what cron exactly runs every minute (or few minutes) in /etc/crontab and /etc/cron.d/ …

8

I have done everything i could think of with anything to do with cronjobs as I mentioned - except the root home dir, which never occurred to me.
For all I know, it’s in a ‘sleep’ loop, which I’ve seen used in other yunohost scripts.
Worse, I guess inotify/dnotify (forget which one we use these days) and I don’t even know where to look for that. Also, systemd.
I’ve seen cronjobs to enforce ownership/perms as far back as Mandrake.
Using old syntax is exactly the kind of mistake I would make, but why would I write a cron to enforce perms on the sso dir in /usr?

9

I suppose you could also grep /var/ and /usr/ …

10

I did grep /var early on. Plenty of binary matches in /usr, of course.