Re: [cobalt-users] auto reboot

[inc@xxxxxxxxxxxxx]

> > > > my server rebooted today without me instigating it.  is this normal?
> > > > Mar 14 08:45:12 www rpc.statd[285]: unable to register (SM_PROG,
> >
> > all i can deduce is that nfs crashed.  is there any reason why i
shouldn't
> > disable nfs?  it doesn't appear to be running but it is linked to in the
> > rc3.d directory......
>
> Well, if you don't use it you don't need it ;)
> make sure the portmapper isn't enabled in inetd.conf...(timestamp?)
>
> Looks to me more like the machine is tryng to start it twice tho...
> (once without privlages)

appears that rpc.statd is started momentarily in /etc/rc.d/init.d/nfslock

i removed the S14nfslock and S20nfsfs


> > i can't find any evidence that someone was in the machine.  the link
> > S55named had yesterday's date on it, but the file itself was unchanged.
i
> > can't see anywhere where rpc.statd is made to run?  i thought that
rpc.statd
> > wasn't used on raq's???
>
> the portmapper can start it, keep in mind, nothing says someone couldn't
> upload a copy ;)
>
> look also for dot files in init.d , new trick i just saw...

ahh yes.  nothing there.  but all i had running at the time was..

Port       State       Service
21/tcp     open        ftp
22/tcp     open        ssh
25/tcp     open        smtp
53/tcp     open        domain
80/tcp     open        http
81/tcp     open        hosts2-ns
110/tcp    open        pop-3
143/tcp    open        imap2
444/tcp    open        snpp
3306/tcp   open        mysql


of those, 3306,444,143 are blocked to external traffic.  no portmap nor
rpc.statd.

puzzlement.

who rebooted me!



:)