Daily mysterious rebooting at 10:55 sharp
 

Hi all you guys! You know I am having a small problem with my RedHat linux 8
box: each night exactly at 10:55 it reboots out of the blue no matter what. I performed a little search on the Web and didn't find something close to my problem other than chkrootkit. I tried it but it says everything is O.K. I suspect that I have been a victim of an attack of some sort because the computer I am sitting at is on-line tweentyfour hours a day wihout a firewall, on a network which is continuously under attacks (scanports, viruses and the like ...). I don't have the experience that my (windows-addicted) collegues have around here and I don't know what to do. So any help/ideas/hints on this would be appreciated. After all, we've got a legacy to consider: Our OS is said to be one of the most stable, safe and virus-free ones around, right?? So, what do you guys think??

P.S.: No that I am thinking about it: could all these be kernel crashings?? I am running a custom kernel (2.4.21), so I guess I should give it a try and fall-back to the default one for a while to see if it makes any difference. Anyway, how can I verify that a kernel-crash happened??

Only thing that springs to mind is to check your cron file for an init 6 command. That would suck.

It may be a shot in the dark, but I think your problem may be due to a cron script executing the reboot command. Also you don't say if the computer just reboots out of the nothing or if the whole shutdown sequence is started (in that case it could be due to the cron service, which is a programable time events on the computer, such as rebooting)

Another idea to see if you were victim of a kernel panic or oops, check your /var/log/messages file to see what's there at any date at 10:55 pm. There should be some information if it were related to kernel.

I use a custom built 2.4.21 CK patched kernel on RH 9 and had no problems with it whatsoever. So try firts checking the cron thing, or if you still have the stock kernel installed and on your grub.conf file, try booting with it and see if the problem occurs.

You mentioned you are on a network without a firewall, but remember that RH has a built in firewall, I don't know what command would let you configure the firewall on RH 8, but try this:
redhat-securitylevel, also check the init.d/iptables file, to add some more restrictive rules to your local firewall (man iptables) and I'd suggest you look for a good iptables HowTo.

Again, this might be a shot in the dark, but I hope this helps.

Thetargos.