Re: Old file reappeared by itself
13.11.2012 17:24, Friedrich Locke: Be very careful, watch your back. Someone may be trying to get you paranoid! And you are following their game. Does anyone else have access to your host ? I doubt it. The only access to the host is via ssh. The last log is not damaged or altered, the all.log is no altered too. The only person who accessed the server is me. Also, the file is restored in some previous condition, but i do not make backups of it and copies are not stored anywhere. I doubt that someone made copies from 2011 and 2012 to the overwrite it. That seems highly unlikely. Have you ever call the police ? Ever - yes, in this case - no. Do you monitor access to your box? Yes. Nothing suspicious found. I really suspect that this is a filesystem glitch. On Tue, Nov 13, 2012 at 10:51 AM, Artem Kuchin mat...@itlegion.ru mailto:mat...@itlegion.ru wrote: 12.11.2012 14:07, Artem Kuchin: The machines runs 4 jails. Everything is in the jails except NAMED. Named is run on the root host (if i may say so) itself. There is a zone file there which i changed last week. Today in the morning i try to open a site and host name is not found. It worked on friday. I went to see the the zone file. IT WAS DATED 2010 I open it and the serial number is something like 201103021. I do all my serials using dates, so, while the file date is 2010 the content is from 2011 and it sure does looks so. Then i go to secondary zone (slave) on another server and there i find the zone from last week. I checked all logs and did not find anything special. The zone file from 2010 just reappeared from nowhere kill all the new changes. As i said, i saw things like this in the past. It happened insides jails and was related to files for web sites and i thought that i and someone else messed up. No i think i saw the same thing. It happened today again! I checked file today and the file was dated 5 oct 2012 but content was from a week ago except the serial. I changed it yesterday. No automatic backup or restore is running. Uptime is 321 day. last says not one has logged in since yerterday. I am going crazy. ___ freebsd-questions@freebsd.org mailto:freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org mailto:freebsd-questions-unsubscr...@freebsd.org -- ? ?, ? ? ?? ?? ?? www.itlegion.ru www.hostilla.ru +7 (495) 232-0338 ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: Old file reappeared by itself
Hello. 2012/11/14 14:25:27 +0400 Artem Kuchin mat...@itlegion.ru = To Friedrich Locke : AK Have you ever call the police ? AK AK Ever - yes, in this case - no. Have police ever called you? ;-) AK It happened today again! I checked file today and the file was Then it's much easier if it happens again. If it's the zone then BIND may seem to overwrite the file? I can do this in the case it's a primary zone service. I'm informed it's all about the primary not a secondary zone service but hence BIND isn't a piece of cake who knows. Since that you can do this: - chmod file(s) for BIND to read-only it. - monitor certain directories for changes. I have no idea about the tool to handle this task but it's quite possible with inotify() system call and/or the sgi fam protocol, particularly its sysutils/gamin implementation. AK ? ?, AK ? ? AK ?? ?? ?? ... Content-Type: text/plain; charset=us-ascii; ? -- Peter Vereshagin pe...@vereshagin.org (http://vereshagin.org) pgp: A0E26627 ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: Old file reappeared by itself
12.11.2012 14:07, Artem Kuchin: The machines runs 4 jails. Everything is in the jails except NAMED. Named is run on the root host (if i may say so) itself. There is a zone file there which i changed last week. Today in the morning i try to open a site and host name is not found. It worked on friday. I went to see the the zone file. IT WAS DATED 2010 I open it and the serial number is something like 201103021. I do all my serials using dates, so, while the file date is 2010 the content is from 2011 and it sure does looks so. Then i go to secondary zone (slave) on another server and there i find the zone from last week. I checked all logs and did not find anything special. The zone file from 2010 just reappeared from nowhere kill all the new changes. As i said, i saw things like this in the past. It happened insides jails and was related to files for web sites and i thought that i and someone else messed up. No i think i saw the same thing. It happened today again! I checked file today and the file was dated 5 oct 2012 but content was from a week ago except the serial. I changed it yesterday. No automatic backup or restore is running. Uptime is 321 day. last says not one has logged in since yerterday. I am going crazy. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
