/etc/resolv.conf file always be changed automatically

[Horia Chirculescu]

How about bootp? Is it running?

Horia.

[Matthew Darcy_2]

what about some sort of IDS like tripwire,

are you changing the file, tripwire (or something) is being run as a scan at 5:00 detecting the change as a monitored file and changing it back.

I've been caught with that before in the past on high security machines, I was only alerted to it when the security team kept getting triggers of file changes.

[diaoxin]

Hi Horia,
bootp is not running on the server.

DiaoXin

[diaoxin]

Hi Darcy,
I can not find IDS under /opt , and find nothing related to ids when I run "swlist ".
For tripwire, how can I know whether tripwire or the other tool installed ?

Thank you!
DiaoXin

[TTr]

Did you check that this is not happening from another server as I pointed out above? You checked every other suggestion except mine.

Check the root's home directory and see if there is a .rhosts file that would allow remsh or rcp to run from another server and copy over the resolv.conf file.

[diaoxin]

Hi TTr,
Sorry for that and thank you for your idea.

I checked the server and there is no .rhosts file existing .

DiaoXin

[TTr]

Check if there are any ftp or ssh connections at 5 am in the syslog (or ftp log if it logs in its own logs)

[diaoxin]

Hi TTr,

I really find there is one user account ssh to the server at 4:00am everyday , and I will try to discuss with the user to deny his ssh connection for test.

Thank you!
DiaoXin

[diaoxin]

Hi TTr,
I discussed with the user about his ssh connection. It is a cronjob for him to collect some information from the server and he only use the normal user permission to do this .
So I think it is not the root cause.

DiaoXin

[Alzhy]

I would bet there is a CFENGINE scheme running. It could be HP's version (forgot the name) or cfengine itself.

Check /var/cfengine.