IP spontaneously static & now appears in bash prompt

[digitaldude]

I am new to linux and had a very strange thing happen the other day that I would really like to fix but don't have a clue how to do it.

The events that I am about to relate might have nothing to do with one another but I don't know so here goes...

I shut down my system while my email client was still running (Thunderbird)

When I rebooted I noticed two strange things.

1. Now my bash prompt shows [bigdog@78-654-899-000 ~]$ (Fake IP) my ip address rather than what it use [bigdog@localhost.localdomain ~]$ (I think that is what it use to say)
2. This has got me more concerned than the above: It appears that my dhcp is no longer working, I mean I seem to have gotten "stuck" with the same ip , almost like it has become static.

These might be unrelated but I would like to know how to go in and change both back. I don't know if there is something in the gnome desktop or of this is just straight command line stuff either way I don't care but I would really appreciate someones help with fixing and checking both.

Lastly, does anyone have any idea why this would have changed on its on in the first place.

Thank a bunch for your help,

DigitalDude

[digitaldude]

I wondering, have I posted this question in the wrong section of the forum? Or is this a stupid question that I have asked?

Here is a different way to maybe get at the problem,...
Question: Is there a default app in thie fedora 8 installation that handles dhcp. I believe that when I did the install I indicated on some screen to let the ip allocation be dynamic and automatic. Now I can't seem to find that option again to try and go back and change my setting to what they once were. I might be mistaken in part or in whole in what I just said but I remember something vaguely like this. Is there some application I can check to see if it is installed that could help reset my ip back to a dynamic one?

Thanks,
DigitalDude

[Iron_Mike]

Or maybe this is an unique issue that no one has encountered before?

Goto system ->administration ->services, and check the DHCP services, if you're not running the box as dhcp server you can stop the service, uncheck the box, and save it and reboot.

[notageek]

Hello DigitalDude,

Please post the output of "hostname"

$ hostname

Also post the following

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0 
$ cat /etc/sysconfig/network

[notageek]

Do you mean you want a DHCP managed IP on your box, instead of a static IP?

If so then /etc/sysconfig/network-scripts/ifcfg-eth0 should read like this

DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
USECTL=no
PEERDNS=yes
TYPE=Ethernet

[digitaldude]

First,Thank you everyone for all your responses.I really appreciate any help.

To answer notageek's question "Do you mean you want a DHCP managed IP on your box, instead of a static IP?" I believe my answer is Yes. I think it was dynamic before simply because I noticed that it change every couple of days and I think that was how I configured it from the initial setup. I don't know now if Fedora 8 default gives the newcomer the kind of options I talked about earlier. From executing the commands that the forum ask me I now kind of doubt my initial thoughts about a menu that comes up early on and let you do this (allow dynamic assignment). I don't doubt that my ip changed because I know that's a fact. I saw it change. But now I have reason to doubt it was dynamic simply because I can't find any dhcp service now. Those are my thoughts and I have the data below with a screen shot. I want to be careful how I proceed so I don't break my internet connection behind the cable modem for my isp.


1. The ip listed below is fake for security reason.
2. the output listed to the hostname command is likewise fake but is of the exact same format and configuration. It too was changed for security reasons. I trust the people on the forum but I am concerned if any mean people out their who might want to punk me if I put out my real ip the mean people might just decide to give me a hard time with a little attack. I'm not paranoid I just want to be careful. I don't mean any offense to the forum or those who are good enough to take their time to help me.
3.my bash prompt just used to say [alpha@7localhost ~]$ or [root@7localhost ~]#
4. I don't know if this has any relevance but I also listed the results of the nmap command so you could see how it "reads" my hostname too.



************************************************** **************************************
[alpha@78-515-22-47 ~]$ hostname
78-515-22-47.mercury.nshvll.tnn.qb3link.net
[alpha@78-515-22-47 ~]$ cat /etc/sysconfig/network-scripts/ifconfig-eth)
bash: syntax error near unexpected token `)'
[alpha@78-515-22-47 ~]$ cat /etc/sysconfig/network-scripts/ifconfig-eth0
cat: /etc/sysconfig/network-scripts/ifconfig-eth0: No such file or directory
[alpha@78-515-22-47 ~]$ cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=localhost.localdomain
[alpha@78-515-22-47 ~]$ su - root
Password:
[root@78-515-22-47 ~]# cat /etc/sysconfig/network-scripts/ifconfig-eth0
cat: /etc/sysconfig/network-scripts/ifconfig-eth0: No such file or directory
[root@78-515-22-47 ~]# hostname
78-515-22-47.lightspeed.hstntx.sbcglobal.net
[root@78-515-22-47 ~]# cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=localhost.localdomain

[root@78-515-22-47 ~]# nmap -sS localhost

Starting Nmap 4.52 ( http://insecure.org ) at 2008-05-08 16:11 CDT
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 1710 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
111/tcp open rpcbind
8000/tcp open http-alt

Nmap done: 1 IP address (1 host up) scanned in 0.093 seconds
[root@78-515-22-47 ~]#

************************************************** *************************************************

Thanks a million
DigitalDude

[notageek]

Okay I'm confused, do you want to keep "78-515-22-47.lightspeed.hstntx.sbcglobal.net" as your hostname?

Probably not.

I see that (from cat /etc/sysconfig/network) your hostname is still defined as localhost.localdomain.

If you want to change hostname to localhost.localdoman try this

$ hostname localhost.localdomain

cat: /etc/sysconfig/network-scripts/ifconfig-eth0: No such file or directory

The command was

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0

Whatever its outcome if you wand an IP from DHCP change the ifcfg-eth0 file to

DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
USECTL=no
PEERDNS=yes
TYPE=Ethernet

Now I'm not terribly certain why this (change of hostname) happed, since I'm not security expert I wouldn't want to speculate.

However my suspision is that someone (or something, prolly a script) called the following on your box

$ hostname 78-515-22-47.lightspeed.hstntx.sbcglobal.net

Which again could be normal if your ISP gives you "direct" access to their network (LAN), that kind of hostname is usually reserved for DSL modems, but I could be wrong and the way they (ISPs) are doing it must have a real good reason.

[digitaldude]

Hello notageek,

Thanks for your help and sorry I'm being confusing.

From notageek: "Okay I'm confused, do you want to keep "78-315-21-47.lightspeed.snantx.sbcglobal.net" as your hostname?"

My goal is to revert my system back to its orignal condition that functioned perfectly fine. Before whatever weird event appeared to have suddenly "locked" my ip to a certain number amd slapped it in my bash prompt.

1. in the orginal condition my host name was localhost.localdomain
2. my bash prompt was [alpha@localhost ~]$ or when I was root it was [root@localhost ~]#
3. I am almost certain I was using dhcp for two reasons 1.) because I "think" I remember selecting that option at the install of fedora 8 and 2.) I know for a fact my ip changed overtime because I would query and find that it was different every few days. This fact unless I am sadly mistaken could not be the case if my ip was "static". So given these premises I would like to "unstick" my ip so that it becomes dynamic (again) and restore my bash prompt to where only "localhost" appears in the prompt and not all of the othe junk.


Sorry for runnning the wrong command earlier. Here is the correct one you asked me to check.


[alpha@72-250-46-78 ~]$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
# nVidia Corporation MCP55 Ethernet
DEVICE=eth0
BOOTPROTO=dhcp
HWADDR=00:1F4:1A:8F:43
ONBOOT=yes
[alpha@74-115-81-80 ~]$


I would tend to think that the script you thought might have been used resulted in the changes that I have reported might be purely "cosmetic." I mean I could use the hostname command to change my host's name to whatever even something silly like
"12.345.56.78" but If I merely assigned my hostname something that was in the form of an ip address that wouldn't actually cause my eth0 to adopt the same number as its ip even though this new name that "looks like" an ip would appear in my bash prompt. Isn't that right?


However, my next question would be if that is the case what would account for the "agreement" in the ip in the bash prompt and what I see listed for the "inet addr:78.213.44.63 " for eth0 when I run ifconfig? (Please see below) This seem to be that the order would be that something, or someone change my ip to a particular address and then subsequent to this change, and possilbly in addtion altered by bash prompt to reflect this more basic internal change. I don't know for sure at all, I'm just trying to think throught this as clearly as possible.
================================================== ================================================== =======
[alpha@78-213-44-63 ~]$ su - root
Password:
[root@78-213-44-63 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 0F:1F8:1A:7F:45
inet addr:78.213.44.63 Bcast:78.123.78.255 Mask:255.255.252.0
inet6 addr: fb23::43f:d8ff:cd21:7q42/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3270 errors:0 dropped:0 overruns:0 frame:0
TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1168801 (1.1 MiB) TX bytes:208713 (203.8 KiB)
Interrupt:253

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:6609 errors:0 dropped:0 overruns:0 frame:0
TX packets:6609 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2651304 (2.5 MiB) TX bytes:2651304 (2.5 MiB)

virbr0 Link encap:Ethernet HWaddr 0F:1E:45:23:A6:60
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
inet6 addr: fe73::81e:66ff:fe43:a451/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:5094 (4.9 KiB)

[root@78-213-44-63 ~]#
================================================== ================================================== =========

Here is my last questions:

Based on your advice it would seem that if I :

1. First as root change the ifcfg file to the example content that you have already provided.
2. Next, use the hostname command to execute the following command [root@78-213-44-63 ~]# hostname localhost

And this likely wouldn't break my internet connection?

Have I understood your advice correctly up to now?

Thanks,
DigitalDude

[notageek]

Hello

I mean I could use the hostname command to change my host's name to whatever even something silly like "12.345.56.78" but If I merely assigned my hostname something that was in the form of an ip address that wouldn't actually cause my eth0 to adopt the same number as its ip even though this new name that "looks like" an ip would appear in my bash prompt.

You're right you can change the hostname to something like michaeljackson or his IP, it will have no impact on your IP address and by induction you'll not become Michael Jackson.

1. There is absolutely no connection between the hostname shown in your bash prompt and your actual IP, sure in your case they are same but they need not be same.

2. The ifcfg-eth0 you've provided tells me that you're already on DHCP

# nVidia Corporation MCP55 Ethernet
DEVICE=eth0
BOOTPROTO=dhcp
HWADDR=00:1F4:1A:8F:43
ONBOOT=yes

3. Based on 2 I don't think you need to change the file.

4. You can change the hostname with the command I've provided, your Internet connection will not break, I'm certain. To reflect the change you'll have to close the bash shell and re-open it (re-login)

5. You may try service network restart to restart your network interfaces, however during the period of the command runs your Internet connection will be down. It'll be back after the command has successfully run.

6. I do not know what kind of Internet connection you have, if its a DSL modem shutting it down for a minute or two will renew your IP address. However from what I see I believe you're connected directly to the Net, and hence restarting the modem (whichever you're using) may not renew your IP.

7. However I'm particularly concerned how this hostname could have changed without your authorizing it. This isn't normal, and from ifcfg-eth0 it is clear that you're on dhcp and yet your IP isn't renewd. Thats very strange.

8. How often do you reboot your Fedora? After changing the hostname does it come back after a reboot?

I'd be very concerned about 7, because I'm paranoid

[notageek]

However, my next question would be if that is the case what would account for the "agreement" in the ip in the bash prompt and what I see listed for the "inet addr:78.213.44.63 " for eth0 when I run ifconfig? (Please see below) This seem to be that the order would be that something, or someone change my ip to a particular address and then subsequent to this change, and possilbly in addtion altered by bash prompt to reflect this more basic internal change. I don't know for sure at all, I'm just trying to think throught this as clearly as possible

For this question, in some companies hostnames are given IP address names, so that when they remote login (through ssh) they immedietly know which box they're on.

And it is particularly this reason why I'm concerned. It would be a worthwhile excercise to look into /var/log/secure and also running

last -i

May or maynot be interesting.

[digitaldude]

Hello notageek,
I am now officially alarmed. I ran the last -i. I think you wanted me to note what the ips were that were logging in. If I am correct all there were was a bunch of zeros like
=================================================
reboot system boot 0.0.0.0 Tue May 6 13:25 (00:14)
alpha pts/1 0.0.0.0 Tue May 6 13:13 - 13:24 (00:10)
alpha pts/1 0.0.0.0 Tue May 6 10:31 - 10:42 (00:11)
alpha pts/1 0.0.0.0 Tue May 6 10:24 - 10:25 (00:01)
alpha pts/1 0.0.0.0 Tue May 6 07:56 - 07:56 (00:00)
alpha tty7 0.0.0.0 Tue May 6 07:55 - 13:24 (05:28)
==============================================
My system is typically up 15-18 hours at a time and then is shut down, day in day out.

Now when I went to /var/log/secure
I saw something that really alarmed me.

I am going to proceed with caution and not even post my finding but I am incessantly being hit from an IP in China try to login using ssh.

I think I really need some help but I want to proceed cautiously. I really don't know that much about security but it looks like I am going to need to.

I don't know who to talk to in details about what I am seeing in /var/log/secure

I am a little concerned about who to trust and whether it is even permissible in the forum to most this ip that the keeps trying to log in with ssh.

I think I really need some help with this but don't know where to begin. But someone from China is definitely trying to beat my door down.

Let me know what you think my next move should be. I would really appreciate any help.

Thanks,
DigitalDude

[urzasrage]

dhcdbd is the package that contains the dhcp client. The actual dhcp process is called dhclient. To check if it is working, enter:
ps `pgrep dhclient`

Are you directly connected to the internet or are you behind a router?

[digitaldude]

When I ran the pgrep dhclient this is what I got back

[topdog@71-212-54-91 ~]$ pgrep dhclient
1908
[topdog@71-212-54-91 ~]$

Please check the image because while my pgrep results indicate a pid of 1908 the GUI doesn't even show that that the service exists

Thanks for all your help,
DigitalDude

[digitaldude]

I have continue to try and determine the nature of the problem and possible origin. I notice that since the problem I have describe above has occurred, i.e., ip in bash prompt and apparently static "behavior" of ip for many days now.

I went to /var/log/messages and noticed an interesting pattern that is present in this log since the time the problem has been seen. I am hoping that someone far more knowledgable than myself might be able to use this "evidence" to help determine may the what and why of the problem and might therefore be able to suggest a solution.

Being a newcommer to Linux and not having a mental frame of reference about what this log data should look like I offer an opinion about what strike me as strange and peculiar about what I notice

There is the repeated "renewal in blank seconds." phrase but no change of ip. Starts at 07:40:48 and ends at 10:30:56 for almost 3 hours each day.

This long series of entries occurs for some length as it does in this sample for everyday that my noted problem has occurred.

It look like it is trying to renew but is never given a new and different ip to renew it is "stuck" on renewing the same old ip.

Anyway, these are my remarks about what I see but this could be completely wrong for many reasons that I don't know.

I really hope someone who know what to make of this data and also knows what not to incorrectly conclude will offer their analysis of the signifcance or lack of significance of these kinds of log entries.


Thanks for all your help,
DigitalDude

/var/log/messages

a segment from today

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%

May 10 07:40:48 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 07:40:48 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 07:40:48 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 230 seconds.
May 10 07:44:38 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 07:44:38 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 07:44:38 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 289 seconds.
May 10 07:49:27 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 07:49:27 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 07:49:27 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 231 seconds.
May 10 07:53:18 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 07:53:18 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 07:53:18 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 271 seconds.
May 10 07:57:49 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 07:57:49 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 07:57:49 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 228 seconds.
May 10 08:01:37 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:01:37 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:01:37 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 249 seconds.
May 10 08:05:46 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:05:46 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:05:46 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 287 seconds.
May 10 08:10:33 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:10:33 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:10:33 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 247 seconds.
May 10 08:14:40 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:14:40 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:14:40 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 261 seconds.
May 10 08:19:01 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:19:01 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:19:01 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 290 seconds.
May 10 08:23:51 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:23:51 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:23:51 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 234 seconds.
May 10 08:27:45 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:27:45 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:27:45 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 292 seconds.
May 10 08:32:37 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:32:37 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 08:32:37 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 238 seconds.
May 10 08:36:35 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 08:36:35 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
*
*
*
*
*
*
*
*
*
*
*
*
*
*
the same repeats through this interval of time with not change. Remove because of restriction
on character count.
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
May 10 09:27:11 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 242 seconds.
May 10 09:31:13 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:31:13 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:31:13 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 291 seconds.
May 10 09:36:04 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:36:04 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:36:04 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 244 seconds.
May 10 09:40:08 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:40:08 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:40:08 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 287 seconds.
May 10 09:44:55 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:44:55 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:44:55 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 248 seconds.
May 10 09:49:03 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:49:03 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:49:03 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 237 seconds.
May 10 09:53:00 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:53:00 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:53:00 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 235 seconds.
May 10 09:56:55 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 09:56:55 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 09:56:55 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 274 seconds.
May 10 10:01:29 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:01:29 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:01:29 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 231 seconds.
May 10 10:05:20 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:05:20 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:05:20 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 246 seconds.
May 10 10:09:26 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:09:26 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:09:26 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 236 seconds.
May 10 10:13:22 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:13:22 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:13:22 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 276 seconds.
May 10 10:17:58 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:17:58 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:17:58 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 286 seconds.
May 10 10:22:44 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:22:44 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:22:44 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 247 seconds.
May 10 10:26:51 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:26:51 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:26:51 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 245 seconds.
May 10 10:30:56 71-212-54-91 dhclient: DHCPREQUEST on eth0 to 87.123.45.254 port 67
May 10 10:30:56 71-212-54-91 dhclient: DHCPACK from 76.250.64.1
May 10 10:30:56 71-212-54-91 dhclient: bound to 71.212.54.91 -- renewal in 251 seconds.

[notageek]

=================================================
reboot system boot 0.0.0.0 Tue May 6 13:25 (00:14)
alpha pts/1 0.0.0.0 Tue May 6 13:13 - 13:24 (00:10)
alpha pts/1 0.0.0.0 Tue May 6 10:31 - 10:42 (00:11)
alpha pts/1 0.0.0.0 Tue May 6 10:24 - 10:25 (00:01)
alpha pts/1 0.0.0.0 Tue May 6 07:56 - 07:56 (00:00)
alpha tty7 0.0.0.0 Tue May 6 07:55 - 13:24 (05:28)
==============================================

This is not something to be alarmed about, since pts is physical terminal, and 0.0.0.0 is your machine itself, it tells me that you've logged into the machine for the periods indicated in the bracket.

Although ssh log in /var/log/secure is something to be really alarmed about.

It look like it is trying to renew but is never given a new and different ip to renew it is "stuck" on renewing the same old ip.

Please contact your ISP immediately!!

I'm not good with security so I'll not give you any advise, a few weeks back there was a thread in security section which discussed what should be the course of action after the system is compromised (although I doubt your system is compromised, but I could be wrong), you may want look at that thread.