0

I'm helping to administer a VM running Ubuntu with Media Temple.

The hostname was changed, and sendmail was removed and replaced with exim4.

To change the hostname 'sudo hostname newhostname' was issued, along with an edit of /etc/hostname.

Also the sendmail log rotate script had to be manually removed from /etc/cron.d/

However, periodically the hostname reverts, and the sendmail cron script re-appears out of thin air.

We have spoken to the hosting company and they insist that they have done nothing.

Is there anything in Ubuntu/Linux that could cause this behaviour?

Edit:

These are the running services:

[ ? ] modules_dep.sh
[ ? ] mysql
[ ? ] network-interface
[ ? ] network-interface-security
[ ? ] networking
[ ? ] ondemand
[ ? ] plymouth
[ ? ] plymouth-log
[ ? ] plymouth-splash
[ ? ] plymouth-stop
[ ? ] portmap
[ ? ] portmap-boot
[ ? ] portmap-wait
[ ? ] procps
[ + ] quota
[ - ] quotarpc
[ ? ] rc.local
[ - ] rsync
[ ? ] saslauthd
[ ? ] screen-cleanup
[ + ] sendmail
[ ? ] sendsigs
[ + ] ssh
[ ? ] stop-bootlogd
[ ? ] stop-bootlogd-single
[ + ] sysklogd
[ ? ] udev
[ ? ] udev-finish
[ ? ] udevmonitor
[ ? ] udevtrigger
[ ? ] umountfs
[ ? ] umountnfs.sh
[ ? ] umountroot
[ - ] urandom
[ ? ] vzquota
[ ? ] vzreboot
[ - ] wide-dhcpv6-client

There are no crontabs for the two users on the server - root and admin. And in ubuntu's cron.d cron.daily etc. directories, there's only one php5 log rotate cron. And the main /etc/crontab file does not have anything in it.

Do any of those services seem like they could be causing the reversion in hostname?

Perhaps this is an issue with something in start-up. Maybe a machine re-boot is causing this. I'll look around /etc/rc.local

3
  • Check all cron scripts (crontab -l) and the directories in /etc and see if there's some "suspected" cron job that may be doing that "reversion"... Also check the services running: service --status-all
    – Feiticeir0
    Apr 26, 2012 at 10:49
  • Many thanks Feiticeir0. I have edited the main question.
    – djangoguy
    Apr 26, 2012 at 11:14
  • Do you know if the Machine is rebooting or something ? does that happens in a reboot ?
    – Feiticeir0
    Apr 27, 2012 at 9:36

1 Answer 1

0

None of your services listed would be doing this. What do your audit logs say? Check the output of last, or wherever Ubuntu stores the auth logs (Sorry I can't be more helpful, I don't run Ubuntu servers).

What I'm thinking is likely is your host typo'd an IP while trying to log into another customers machine, and started making changes that the other customer requested. There's no real way to tell without checking your login/audit logs though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .