my server was rebooted
I noticed my FreeBSD server was rebooted
"last" shows a "reboot" entry after a "crash" on proftpd:
reboot ~ Sat Feb 25 08:55
XXX ftp 201.22.xxx.xxx Sat Feb 25 08:49 - crash (00:06)
/var/log/messages doesn't show anything very useful too, but doesn't say the server was being rebooted:
it jumps from:
Feb 25 08:48:58 server03 proftpd[97111]: ns1.xxx.com (201.22.xxx.xxx[201.22.xxx.xxx]) - FTP no transfer timeout, disconnected
to (after reboot):
Feb 25 08:55:45 server03 /kernel: Copyright (c) 1992-2005 The FreeBSD Project.
- rkhunter doesn't show anything suspicious
- /var/log/cron doesn't show any process run on that time
- this didn't happen again after 1 hour
- kernel wasn't changed (or was so changed that it was programmed to show it wasn't changed
... since there's no high load activity on my server before the reboot (monitored by rrdtool), I doubt that someone recompiled a kernel... they could put a precompiled one, but I guess it's not very common ... I also logged right after the reboot and no one was logged)- tripwire doesn't show significant changed (but again, I can be living on a "matrix" server, but I've never heard about some "so successful" attack on a normal server, so it's probably not the case)
any hints?
