topic Directory missing in Operating System - HP-UX

Directory missing

yulianto piyut — Thu, 06 Dec 2007 03:14:29 GMT

hi all,

how to trace directory missing ? my system running hp-ux 11.11. I tried to trace this problem by made 2 directory under home directory of user, one direcotory owner by user and the other owner by root. the directory owner by user is missing at 30 nov. i created it at 14 nov. i have checked at history file (.sh_history) of user but there are no commands like "rm" or "mv".

many thanks for your valuable time to give me a suggestions about it.

-yut-

Re: Directory missing

Steven Schweda — Thu, 06 Dec 2007 03:43:08 GMT

User "root" could delete anything and not
leave any trace in ~user/.sh_history.

User "user" could use a shell which does not
leave any trace in ~user/.sh_history.

There are many ways for this to happen and
leave no obvious traces.

If you really need to know who deletes some
item, then you'll need to enable some fancy
auditing. (Fancier than I know how to do on
HP-UX.)

Re: Directory missing

yulianto piyut — Thu, 06 Dec 2007 03:46:39 GMT

I have tried in testing server. I made testing server to trusted system and running auditing, but i cann,t see the log of command "rm" or "mv".

Re: Directory missing

A. Clay Stephenson — Thu, 06 Dec 2007 04:16:16 GMT

Bear in mind that anyone who has write permission on a directory can remove files (and directories are files too) in that directory. What are the permissions on this directory and who owns the directory and what group?

Looking at .sh_history will only catch the obvious, deliberate rm's but the unlink() could have been done inside a program or script and .sh_history wouldn't have a clue.

You might consider setting the sticky bit on the parent directory so that only the owner or root could delete files under that directory.

Re: Directory missing

Kapil Jha — Thu, 06 Dec 2007 04:57:45 GMT

If you are just lookin at .sh_history...if somebosy really interested in deleteing he would remove that command from .sh_history also.....
Clay's suggestion for sticky bit is amazing....
BR,
Kapil