topic Linux NTP issue in Operating System - Linux

Linux NTP issue

Tom Wolf_3 — Wed, 19 Nov 2008 16:58:28 GMT

Hello, we have a Red Hat Enterprise Linux ES release 4 (Nahant Update 5) server that seems to be sending packets containing the time to three different external servers:

121.50.43.11
121.50.43.12
c-biznet.com

We checked the /etc/ntp.conf file on this server and it's configured the same as all the other hosts in our environment - the 121.50.43 and c-biznet.com addresses aren't in the file.

We also checked the /usr/sbin/ntpd binaries and they are the same as all the other Linux hosts in our environment. Only a single Linux server in our organization is experiencing this issue.

When we stop NTP, the packets stop being sent to the three addresses. When we restart NTP on this server, the packets start transmitting again.

We ran a virus scan and came back with nothing.

Do any of the Linux experts out there have any suggestions on how to determine where these three addresses are being referenced from and how to stop this issue?

Any help would be greatly appreciated.

Thank you.

Tom Wolf

Re: Linux NTP issue

Fredrik.eriksson — Thu, 20 Nov 2008 07:43:21 GMT

Well I'm not entirely sure, but the first thing I would try is something like this:
$ grep -R "c-biznet.com" /etc/*

This is just to make sure nothing stupid is getting included or is set in another place.
Then, I'm not entirely sure this will lead somewhere thou, I would probably check set and env for any misschief variables.

If the addresses is used they are usually written down somewhere. I would just recommend searching some more.

Best regards
Fredrik Eriksson

Re: Linux NTP issue

Jeeshan — Thu, 20 Nov 2008 19:06:34 GMT

run this command

#cat /etc/ntp/ntpservers

or

#cat /etc/ntp/step-tickers

Re: Linux NTP issue

Tom Wolf_3 — Thu, 20 Nov 2008 20:17:13 GMT

Thanks for both responses.

Unfortunately they did not provide any new leads.

We did a recursive search of all files using the find command but did not have any matches. We searched for all three addresses.

Any other suggestions?

Thanks again.

Re: Linux NTP issue

Ragu_3 — Fri, 21 Nov 2008 05:05:47 GMT

>> how to determine where these three addresses are being referenced

They all maybe part of the server pool list referenced by the server lines like '0.rhel.pool.ntp.org' in /etc/ntp.conf.

Nobody runs a virus scan on a GNU/Linux machine, run 'rkhunter' instead.

All these; 121.50.43.11, 121.50.43.12, c-biznet.com maybe stratum-3 servers.