Owner of files being changed

[yc_2]

Hi,

The owner of some informix files were changed from root to informix in one of my system. Any advise how I can track and prevent this.


Rgds,
YC

[Andreas Voss]

Hi,

to have a hint of when this happens do a:
ll -c
This lists the files in order of the inode modification (chown, chmod) time.

Regards

[yc_2]

Hi Andreas,

Thanks your advise, I got the date and time for changed of the files.

Is there a way to trace who and from where the command is issued because no one will work at the hour.

[Andreas Voss]

Hi,

the only thing i know to review this is enabling auditing but i think you haven't.

Regards

[yc_2]

Hi Andreas,

Yes, the audit was not turned on. There were some issues from my user side about trusted system.

1) Can audit trail be turned on without converting to trusted system ?

2) I have another system which had audit turned on, how to I audit root account.


Rgds,
YC

[Andreas Voss]

Hi,

think audit can be enabled without turning to trusted system.
See man 5 audit.
To activate edit /etc/rc.config.d/auditing

Regards

[yc_2]

Hi,

I had turned on the audit without converting the system to trusted system but the cron compliants there is no audit ID.

Any advise, thanks in advance.


YC

[Paula J Frazer-Campbell]

Hi
You said that the time the files were changed was when users were not working.

So Informix has changed the file ownership.

What was Informix doing at that time?

Paula