A Ghost in my Server?

Today I had a wierd experience. As a part of my work as a teaching assistant in the Information Security course at University I am the administrator for one server running RedHat Linux 8.0. Having worked with UNIX for some 5 years I believe I am quite proficient, but today I was tricked.

The story is that we took the server down some weeks back as someone needed the hardware (and I didn't really need it anymore). As I am now in the process of documenting my work and moving on in life we booted the machine again on Wednesday. After some problems with the network connections we got it going, this time on a new network, so changes in the IP configuration was needed.

After first checking the network connection by using DHCP we decided to give it a static address. No worries. Worked. I logged out and left the server room. When I checked in to do some work later that day the server was 'gone'. No answer to ping, no nothing. Being short of time (and not having a key to the server room) I didn't really care all that much. Telling myself that I did something wrong when configuring the network.

This morning I went back in there and got the problem sorted out. The server was indeed on the wrong IP. Slightly puzzled I changed the IP to the correct value and all seemed well. Then some 6 hours later it disappeared again. Gone. Now, having seen this one before I tried out the IP that it was found at the same morning. And guess what I found? A happy running server. Now I got scared. How come my server is changing IPs? Being the only one with the root password I was afraid of having been hacked.

Before panicing I decided to just check what kind of processes that were up. And guess what I found? A DHCP client -- probably from when I used DHCP earlier during the week. I presume that it has dutifully been following orders all week -- checking my IP every few hours and changing it back from the static address to the dynamic one whenever I did the opposite... *sic*

Posted by ludvig at June 27, 2003 09:04 PM | TrackBack