DD machine mysterious reboot
Greetings,
One of my machines mysteriously rebooted yesterday at 7:42 AM without
any prompting. It could not have been a power outage; tried pulling the
plug and it does not come back up automatically when plugged back. And
I don't have automatic security upgrades on the machine (not sure if
those trigger a reboot).
There's nothing especially suspicious in the logs, just a bunch of
user/password guesses via ssh, which is port forwarded from a separate
firewall/router, and is the only externally open port on that
firewall/router. /var/log/messages has --MARK-- entries right up to
7:20, a syslog restart at 7:35 (per cron, as usual), then another syslog
restart and booting messages starting at 7:42.
I guess I'm wondering: how concerned should I be? Can you think of
other reasons the machine might have auto-rebooted? It appears to have
happened right after the morning cron exercises; do any common cron jobs
reboot the machine? I'd like to avoid a reinstall if possible, but if I
can't come up with an explanation other than a break-in, I'll have to
bite the bullet and do it. :-(
The machine only has my ssh authorized_keys, and I never forward
authorization to it, and it doesn't have any common passwords with any
of my other machines, so nobody can use it directly to log in elsewhere.
(And I don't have any keys on Debian machines, I only use
anonymous-ftp-master.)
Thanks in advance for any help you can provide.
-Adam
--
GPG fingerprint: D54D 1AEE B11C CE9B A02B C5DD 526F 01E8 564E E4B6
Welcome to the best software in the world today cafe!
http://www.take6.com/albums/greatesthits.html
Reply to: