On Don, Apr 13, 2000 at 12:17:58 +0200, Christoph Schaefer wrote:
Our server is in trouble -- and so are we --
every night at 00:00 the /etc/passwd-file is erased (= set to size 0) up to now we checked the following things:
* tcpdump (... no suspicious connections) * log-files (... are ok) * cron-jobs (... no suspicious cron-jobs)
the passwd-problem seems to be the only peculiarity -- at least we think so.
Hmm, every night at 00:00 at my linux box starts the cron.daily. One of it's tasks is to reduce the size of log files. The effect you wrote is exactly equal to a log file rotate processed by /etc/cron.daily/aaa_base. Did someone add /etc/passwd to the config file /etc/logfiles? If not you can check also: - all files in /etc/cron.daily (grep passwd /etc/cron.daily/*) - all links to /etc/passwd (find / -lname passwd ...) and (if found) the /etc/logfiles hth Jan