Changed of owner

[yc_2]

Hi,

Experienced owner's directory and file being changed to another owner. Is there a way to check why and how it was changed.

Note: HP-UX 11.00 on N-class non-trusted system.

Thanks in advance,
YC

[Vincenzo Restuccia]

.sh_history

[A. Clay Stephenson]

Hi,

This was done by the user himself, by root, or by a user who su'ed to root.

Since this is a non-trusted system, you can only determine this it if occurred recently.

AS has been noted, examine .sh_history the this user and of root. Next examine /var/adm/sulog and /var/adm/OLDsulog and if any users have su'ed to root examine their .sh_history file. You should also note any users in sulog that you don't expect to be able to su to root. It is also possible that a user su'ed to this user and then changed the file ownership.

Good hunting, Clay

[Jonathan Corbeill]

Another possibility is if you removed a user and manually edited the /etc/passwd file. Each file has a user number associated with it. If you change the name behind the number then listing files in the filesystem will lookup the owner number and translate it to the new user.