topic Re: Changed of owner in Operating System - HP-UX

Changed of owner

yc_2 — Mon, 28 May 2001 05:23:54 GMT

Hi,

Experienced owner's directory and file being changed to another owner. Is there a way to check why and how it was changed.

Note: HP-UX 11.00 on N-class non-trusted system.

Thanks in advance,
YC

Re: Changed of owner

Vincenzo Restuccia — Mon, 28 May 2001 08:47:07 GMT

.sh_history

Re: Changed of owner

A. Clay Stephenson — Mon, 28 May 2001 10:16:17 GMT

Hi,

This was done by the user himself, by root, or by a user who su'ed to root.

Since this is a non-trusted system, you can only determine this it if occurred recently.

AS has been noted, examine .sh_history the this user and of root. Next examine /var/adm/sulog and /var/adm/OLDsulog and if any users have su'ed to root examine their .sh_history file. You should also note any users in sulog that you don't expect to be able to su to root. It is also possible that a user su'ed to this user and then changed the file ownership.

Good hunting, Clay

Re: Changed of owner

Jonathan Corbeill — Tue, 29 May 2001 18:52:30 GMT

Another possibility is if you removed a user and manually edited the /etc/passwd file. Each file has a user number associated with it. If you change the name behind the number then listing files in the filesystem will lookup the owner number and translate it to the new user.