Strange reboot

A friend of mine and I use a Debian box to host some files and to provide us with an IRC shell. This morning the box was inaccessible via SSH, so I told my friend to check if renewing the IP address would help. It did, and I managed to connect to the box.

I soon found out that irssi I had running in screen was gone. Also uptime had dropped from about 90 days to 20 minutes. Something had rebooted the box.

There had been no power outage in the house the box is in. I could find nothing suspicious in the server log, so I don't think the box was compromised either. What could cause a reboot like that?

What do you mean irssi was gone? It was not running any more? or had been deleted?

Didn't run anymore.

Just because you did not see anything in the error logs this does not mean the box was not compromised. The first thing they will do is cover their tracks by cleaning the logs. Many times you will see a strange new user in the passwd file. I would re-think unauth entry

Nice to see you back, cow!

However, the friend said that it is possible that there would have been a very short power outage, and that the box would have started by itself because the power on button might have been stuck or something.

As for the unauth entry, how do I add one?

Good to see you too friend.



No, I meant you should look again for an un-authorized entry to the box. A power outage would do just that though

I wonder which orbit my thoughts were on. I thought that auth==authentication so unauth would be logging out. And now that I rechecked the log I noticed that it does make an entry for logging out via ssh