LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-21-2010, 12:43 AM   #1
janhouse00
LQ Newbie
 
Registered: Mar 2005
Posts: 8

Rep: Reputation: 0
Multiple reboots by CRON. Possible server compromise?


Hi all,

I just ordered an unmanaged vps (openvz-based) last week. There's nothing much on the server, just running sshd, proftp and apache stuff for testing. Everything was fine till today morning. I realized that the server was rebooted for like five times in a row. I do notice there's some SSH dictionary attacks from time to time, but I employ hosts.deny, disable rootlogin and other safety measures, so basically those attempts don't succeed. I don't run any cron job either, just some logrotate and logwatch entries in the hourly/daily/weekly/monthly cronjob dirs.

reboot system boot 2.6.18-128.2.1.e Fri May 21 07:51 - 09:02 (01:11)
reboot system boot 2.6.18-128.2.1.e Fri May 21 07:32 - 07:51 (00:18)
reboot system boot 2.6.18-128.2.1.e Fri May 21 03:56 - 07:15 (03:18)
reboot system boot 2.6.18-128.2.1.e Fri May 21 03:38 - 03:55 (00:16)
reboot system boot 2.6.18-128.2.1.e Fri May 21 01:26 - 03:55 (02:29)


May 21 03:39:28 myvps /usr/sbin/cron[28546]: (CRON) INFO (pidfile fd = 3)
May 21 03:39:28 myvps /usr/sbin/cron[28554]: (CRON) STARTUP (fork ok)
May 21 03:39:30 myvps /usr/sbin/cron[28554]: (CRON) INFO (Running @reboot jobs)


May 21 04:54:59 myvps /usr/sbin/cron[1524]: (CRON) INFO (pidfile fd = 3)
May 21 04:54:59 myvps /usr/sbin/cron[1529]: (CRON) STARTUP (fork ok)
May 21 04:54:59 myvps /usr/sbin/cron[1529]: (CRON) INFO (Running @reboot jobs)

Nothing looks suspicious from the log files, even single reboot would take hours. Eg. 03:56 - 07:15 (03:18). I just couldn't figure out what's wrong. Is my box having problem?

P/S: My vps is back online now, after the recent reboot. I shut down some services at the moment except sshd is listening.

Last edited by janhouse00; 05-21-2010 at 12:44 AM.
 
Old 05-21-2010, 07:41 AM   #2
janhouse00
LQ Newbie
 
Registered: Mar 2005
Posts: 8

Original Poster
Rep: Reputation: 0
Duh, looks like it was probably unscheduled maintenance.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Debian Server restored after Compromise LXer Syndicated Linux News 0 07-14-2006 02:54 AM
Cron to reboot server? ballistic509 Debian 12 04-23-2006 12:22 PM
cron reboot problem tcpdump Linux - Software 3 05-14-2004 06:05 AM
Cron starting multiple copies of a server rmount Programming 0 05-11-2004 12:43 PM
Cron Reboot Virtus Linux - Software 3 01-13-2003 07:42 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:30 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration