the actual time and what's showing in the GUI...<??> It's only with one box; the other two have perfect time... I took this snap at exactly 3:03 AM EST, and this is what the server is showing.
If the timezine info can not be read, UTC is used by default, (which >>oddly enough is 5 hours ahead of EST).. make sure /etc/localtime >>points to a timezone file that actully exists (it's a symlink), should >>point to something like /usr/share/zoneinfo/US/Eastern(Timezone handling is probably the most screwed thing in unix ;)
I agree with you.But I want to clarify in case it this can help someone else going through these hacks - as it turns out (we were also hacked), this was the result of the exploited files they dropped into the box. It was also making PS do wild and fun things... After posting, we noticed that all the log entries were correct; it was just showing 5 hours ahead when doing PS.
One other thing; the day or two prior, one of our customers in CA was having all kinds of trouble connecting via FTP/POP services. We just tossed it up to ISP issues as traces and pings from our end were okay, as were the POP3 services. But the customer kept reporting that he (and the network admin at his job) were running traces and coming back with a completely different IP.. Now I?m thinking this was the work of the hacker, routing things somewhere else? I?m going to contact the user tomorrow and see if he still has those traces (from him to us) so we can investigate further.
-Craig _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com