topic Re: Checking File Permissions in Operating System - HP-UX

Checking File Permissions

Sanjay Verma — Tue, 26 Mar 2002 05:20:10 GMT

Hi,

I require the solution for the mentioned query asap:

Scenario: User "a" modified the file permissions of "xxx" file. How user "b" can identify who has modified the "xxx" file?

Hope to find the solution from the expert brains.

Regards,
Sanjay

Re: Checking File Permissions

K.Vijayaragavan. — Tue, 26 Mar 2002 05:29:27 GMT

Hi,

If that file was properly secured only the root and the owner of the file can do it.

If that file "xxx" had write permission for the group members any body from that group might have done it.

If it had write permission for the others any body can change the permission on it.

But there is no way to find who has changed the permission of a file to it's present state.

-Vijay

Re: Checking File Permissions

Michael Tully — Tue, 26 Mar 2002 05:34:38 GMT

Unless the user has a .sh_history file, you
might be out of luck. Do have system accounting or auditing running?

Solutions:
If the file was owned by 'root' change the root
password.
Implement 'sudo'

Re: Checking File Permissions

steven Burgess_2 — Tue, 26 Mar 2002 05:37:19 GMT

Hi

do an ll on the file, when was it changed ?

do a last | more to see who was logged when the file was modified

if you have any idea who may have changed it you could check there .sh_history in there home directory, you will be able to see their last commands

Regards

Steve

Re: Checking File Permissions

Stefan Schulz — Tue, 26 Mar 2002 07:00:01 GMT

HI,

as far as i know there is no information stored in the inode who changed the filepermissions. So there is no way to check this afterwards.

The only thing i can think of is some kind of auditing. This already helped me a lot on a Novell Server. But i don't have experience with the auditing that comes with HP-UX.

Hope this helps

Regards Stefan

Re: Checking File Permissions

Deepak Extross — Tue, 26 Mar 2002 10:40:41 GMT

I must be missing something here, but I thought that ONLY the file owner or root could change the permissions.

Just tested it out, and even though my test file has 777 permissions, a different user cannot chmod it. Does the permission on the directory holding the file have anything to do with this?

Re: Checking File Permissions

Ruediger Noack — Tue, 26 Mar 2002 10:54:18 GMT

Deepak,

I agree absolutely!

Ruediger

Re: Checking File Permissions

pap — Tue, 26 Mar 2002 16:38:37 GMT

Hi,
One can change the file permissions if

1. He is a root user.
2. If the user is belongs to group membership of that file.

3. Owner of that file.

If you want to find out who changed the file permissions, just keep focus on group members of that file. Then examine the .sh_history fiel and you will come to kno who changed the file permissions.

-pap

Re: Checking File Permissions

Ralph Grothe — Tue, 26 Mar 2002 17:03:00 GMT

Deepak,

if the directory that holds the file has the write bit set for user or group of user who wants to modify the file, and has not set the sticky bit, then this person could replace the file with a namesake file of his own with other permission bits.
Thus, he indeed can indirectly chmod of a file.

Re: Checking File Permissions

Sanjay Verma — Wed, 30 Apr 2003 02:33:09 GMT

Hi Friends,
Thanks for your response and sorry for the delay in assigning points.
Yes, the issue was resolved after using the "scmd" command. Worthwile trying it.