[cobalt-security] Qube2s LCD and services freeze every 7 Days

[Snowy Elf <snowy_elf@xxxxxxx>]

We thought our Qube2 boxes we were under a DoS attack and that the boxes were
"nuked" out of commision, though have no way of determining if that is the
case.
We have 2 Qube2s and found that all the services, the LCD screen, and
buttons freeze up and require a power down every 7 days. We are only running
Web, Mail, and DNS services. Noting the posting dating 8-26-2000 in the
archives, there have been serveral other Qube2 users experiencing the same
problem. We are not using SMB or the backup services on the boxes. The boxes
started to freeze since we applyed all the latest security fixes as of 2 weeks
ago and updates that were not part of the Restore-CD install; and also since
their connection to the Internet. We have Logcheck installed doing a 30 min
sweep and did not report any secuirty violations or unsual system events even
after power down and power back on; it merely reported that the machine was
restarted. We believe the timing is every 7 days. The machine went up on the
9th and went down on the 13th. It went down the second time 7 days later on
the 20th. We believe that there is something in cron schedule that happens on
a weekly basis that is nuking our boxes. Looking in /etc/cron.weekly there is
a file called makewhatis that has the contents :
#!/bin/bash

LOCKFILE=/var/lock/makewhatis.lock

We also manually removed all the man pages to save space and wonder if this
entry in /etc/crontab would make the boxes freeze :

# Remove formatted man pages not accessed in 10 days
39 02 * * * root /usr/sbin/tmpwatch 240 /var/catman/cat?

or mabye this :
# Remove /tmp, /var/tmp files not accessed in 10 days (240 hours)
41 02 * * * root /usr/sbin/tmpwatch 24 /tmp /home/tmp /var/tmp
/var/cobalt/tmp

Should we try to comment out the 10 day entries above and cross out fingers
and see if we can get more than 7 days of uptime?


Thanks, any advice is appreciated

____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1