Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 14 Nov 2012 14:25:27 +0400
From:      Artem Kuchin <matrix@itlegion.ru>
To:        Friedrich Locke <friedrich.locke@gmail.com>,  "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject:   Re: Old file reappeared by itself
Message-ID:  <50A37197.2010605@itlegion.ru>
In-Reply-To: <CANMDHqemVfGwNo5uPDmzbis=NXW=Qn2zMR%2B6i=Snma_smmbcwQ@mail.gmail.com>
References:  <50A0CA53.8050802@itlegion.ru> <50A24258.6080203@itlegion.ru> <CANMDHqemVfGwNo5uPDmzbis=NXW=Qn2zMR%2B6i=Snma_smmbcwQ@mail.gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help

13.11.2012 17:24, Friedrich Locke:
> Be very careful, watch your back.
> Someone may be trying to get you paranoid! And you are following their 
> game.
> Does anyone else have access to your host ?

I doubt it. The only access to the host is via ssh. The last log is not 
damaged or altered, the all.log is no altered too.
The only person who accessed the server is me.
Also, the file is restored in some previous condition, but i do not make 
backups of it and copies are not stored anywhere.
I doubt that someone made copies from 2011 and 2012 to the overwrite it. 
That seems highly unlikely.

> Have you ever call the police ?

Ever - yes, in this case - no.

> Do you monitor access to your box?

Yes. Nothing suspicious found.
I really suspect that this is a filesystem glitch.

>
>
>
> On Tue, Nov 13, 2012 at 10:51 AM, Artem Kuchin <matrix@itlegion.ru 
> <mailto:matrix@itlegion.ru>> wrote:
>
>
>     12.11.2012 14:07, Artem Kuchin:
>
>         The machines runs 4 jails. Everything is in the jails except
>         NAMED.
>         Named is run on the root host (if i may say so) itself.
>         There is a zone file there which i changed last week.
>         Today in the morning i try to open a site and host name is not
>         found. It worked on friday.
>         I went to see the the zone file. IT WAS DATED 2010 !!!! I open
>         it and the serial number is
>         something like 201103021. I do all my serials using dates, so,
>         while the file date is 2010
>         the content is from 2011 and it sure does looks so.
>         Then i go to secondary zone (slave) on another server and
>         there i find the zone from last week.
>         I checked all logs  and did not find anything special. The
>         zone file from 2010 just reappeared
>         from nowhere kill all the new changes.
>         As i said, i saw things like this in the past. It happened
>         insides jails and was related to files
>         for web sites and i thought that i and someone else messed up.
>         No i think i saw the same thing.
>
>
>     It happened today again! I checked file today and the file was
>     dated 5 oct 2012 but content was
>     from a week ago except the serial. I changed it yesterday. No
>     automatic  backup or restore is running.
>     Uptime is 321 day.  last says not one has logged in since yerterday.
>     I am going crazy.
>
>
>     _______________________________________________
>     freebsd-questions@freebsd.org
>     <mailto:freebsd-questions@freebsd.org> mailing list
>     http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>     To unsubscribe, send any mail to
>     "freebsd-questions-unsubscribe@freebsd.org
>     <mailto:freebsd-questions-unsubscribe@freebsd.org>"
>
>

-- 
? ?????????,
????? ?????
???????? "?? ?? ??????"
www.itlegion.ru
www.hostilla.ru
+7 (495) 232-0338




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50A37197.2010605>