Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm helping to administer a VM running Ubuntu with Media Temple.

The hostname was changed, and sendmail was removed and replaced with exim4.

To change the hostname 'sudo hostname newhostname' was issued, along with an edit of /etc/hostname.

Also the sendmail log rotate script had to be manually removed from /etc/cron.d/

However, periodically the hostname reverts, and the sendmail cron script re-appears out of thin air.

We have spoken to the hosting company and they insist that they have done nothing.

Is there anything in Ubuntu/Linux that could cause this behaviour?

Edit:

These are the running services:

[ ? ] modules_dep.sh
[ ? ] mysql
[ ? ] network-interface
[ ? ] network-interface-security
[ ? ] networking
[ ? ] ondemand
[ ? ] plymouth
[ ? ] plymouth-log
[ ? ] plymouth-splash
[ ? ] plymouth-stop
[ ? ] portmap
[ ? ] portmap-boot
[ ? ] portmap-wait
[ ? ] procps
[ + ] quota
[ - ] quotarpc
[ ? ] rc.local
[ - ] rsync
[ ? ] saslauthd
[ ? ] screen-cleanup
[ + ] sendmail
[ ? ] sendsigs
[ + ] ssh
[ ? ] stop-bootlogd
[ ? ] stop-bootlogd-single
[ + ] sysklogd
[ ? ] udev
[ ? ] udev-finish
[ ? ] udevmonitor
[ ? ] udevtrigger
[ ? ] umountfs
[ ? ] umountnfs.sh
[ ? ] umountroot
[ - ] urandom
[ ? ] vzquota
[ ? ] vzreboot
[ - ] wide-dhcpv6-client

There are no crontabs for the two users on the server - root and admin. And in ubuntu's cron.d cron.daily etc. directories, there's only one php5 log rotate cron. And the main /etc/crontab file does not have anything in it.

Do any of those services seem like they could be causing the reversion in hostname?

Perhaps this is an issue with something in start-up. Maybe a machine re-boot is causing this. I'll look around /etc/rc.local

share|improve this question
    
Check all cron scripts (crontab -l) and the directories in /etc and see if there's some "suspected" cron job that may be doing that "reversion"... Also check the services running: service --status-all –  Feiticeir0 Apr 26 '12 at 10:49
    
Many thanks Feiticeir0. I have edited the main question. –  djangoguy Apr 26 '12 at 11:14
    
Do you know if the Machine is rebooting or something ? does that happens in a reboot ? –  Feiticeir0 Apr 27 '12 at 9:36

1 Answer 1

None of your services listed would be doing this. What do your audit logs say? Check the output of last, or wherever Ubuntu stores the auth logs (Sorry I can't be more helpful, I don't run Ubuntu servers).

What I'm thinking is likely is your host typo'd an IP while trying to log into another customers machine, and started making changes that the other customer requested. There's no real way to tell without checking your login/audit logs though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.