On Tue, Oct 24, 2017 at 08:12:20AM -0400, Greg Wooledge wrote: > On Mon, Oct 23, 2017 at 07:33:01PM -0400, Roberto C. Sánchez wrote: > > So, I edited resolv.conf to my preference and then made it immutable > > with `chattr +i /etc/resolv.conf`. Several hours later the name server > > was changed back to the ISP router's address. That is very odd. > > ls -ld /etc/resolv.conf > > > On Tue, Oct 24, 2017 at 03:15:30AM -0400, Roberto C. Sánchez wrote: > > > > So if you: > > > > $ ls -l --full-time /etc/resolv.conf > > > > and then look at what happened at that precise time in /var/log/syslog > > > > or wherever your logs are being written. What took place? > > And what does the ls actually SHOW? > > > So, it happened again at 03:02:26 that resolv.conf was changed. > > ls -ld /etc/resolv.conf > > If it's a SYMLINK and you made the symlink immutable, well, that would > explain a whole lot. >
It is not a symlink: debian:/etc# ls -l --full-time /etc/resolv.conf -rw-r--r-- 1 root root 25 2017-10-24 07:07:54.513938427 -0400 /etc/resolv.conf debian:/etc# file /etc/resolv.conf /etc/resolv.conf: ASCII text Regards, -Roberto -- Roberto C. Sánchez
