Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a CentOS 5.5 machine and it has a domain name assigned to it and all of a sudden that domain name is gone and it shows its domain name as "fqdn". the login shows as [root@fqdn] and "hostname" command returns "fqdn". any idea whats going wrong here ? or what should I be looking for in this case.

By the way I have some errors in my dmesg

type=1400 audit(1345154461.224:5387): avc:  denied  { write } for  pid=13584 comm="ip" path="/tmp/netchklog" dev=dm-0 ino=393854 scontext=user_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
type=1400 audit(1345154521.247:5388): avc:  denied  { write } for  pid=14104 comm="ip" path="/tmp/netchklog" dev=dm-0 ino=393854 scontext=user_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
share|improve this question

migrated from stackoverflow.com Aug 22 '12 at 6:40

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

FQDN stands for Fully Qualified Domain Name, apparently someone reset it to some default.

You can reset it with:

# hostname <hostname>

as root of course.

Note though that this has nothing to do with any DNS A/CNAME records you might have.

share|improve this answer
    
No one touches these machines. I knew I can change the name back, but I am trying to figure out why this happened before I reset the name or reboot the box. –  voldemort Aug 17 '12 at 14:13
    
Have you considered an attack / rootkit ? –  Bart Friederichs Aug 17 '12 at 14:45
    
No. It doesn't look like it had a attack. I reset my hostname back, but still its a mystery on how it got changed. –  voldemort Aug 17 '12 at 15:18
add comment

First of all CentOS 5.5 is pretty EoL. Current version is 5.9 - so this might have been a successful attack on your system.

Second - check your dhcp-settings. It might be that you set it so it automatically changes the fqdn. Has anything changed on your dhcp-server?

/etc/sysconfig/network is the place where the hostname is set reboot-safe. When was it last modified? Try to correlate this date/time to other events.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.