Directory missing

[yulianto piyut]

hi all,

how to trace directory missing ? my system running hp-ux 11.11. I tried to trace this problem by made 2 directory under home directory of user, one direcotory owner by user and the other owner by root. the directory owner by user is missing at 30 nov. i created it at 14 nov. i have checked at history file (.sh_history) of user but there are no commands like "rm" or "mv".

many thanks for your valuable time to give me a suggestions about it.

-yut-

[Steven Schweda]

User "root" could delete anything and not
leave any trace in ~user/.sh_history.

User "user" could use a shell which does not
leave any trace in ~user/.sh_history.

There are many ways for this to happen and
leave no obvious traces.

If you really need to know who deletes some
item, then you'll need to enable some fancy
auditing. (Fancier than I know how to do on
HP-UX.)

[yulianto piyut]

I have tried in testing server. I made testing server to trusted system and running auditing, but i cann,t see the log of command "rm" or "mv".

[A. Clay Stephenson]

Bear in mind that anyone who has write permission on a directory can remove files (and directories are files too) in that directory. What are the permissions on this directory and who owns the directory and what group?

Looking at .sh_history will only catch the obvious, deliberate rm's but the unlink() could have been done inside a program or script and .sh_history wouldn't have a clue.

You might consider setting the sticky bit on the parent directory so that only the owner or root could delete files under that directory.

[Kapil Jha]

If you are just lookin at .sh_history...if somebosy really interested in deleteing he would remove that command from .sh_history also.....
Clay's suggestion for sticky bit is amazing....
BR,
Kapil