Files without ownership/group

[Nobody's Hero]

Hey all,

I am now an in Security for the Government, not the admin anymore and I dont have access to test a command right now. Is there a find option or combined one or 2 liner script that will show me all files that DO NOT have either an owner or group. We look for files that are missing group ownership and ones that are missing file ownership.

[Denver Osborn · Accepted solution]

find / -local -nogroup -print
find / -local -nouser -print

-denver

[Derek Whigham_1]

Yeap , This is how to do it

find . -nouser -print

find . -nogroup -print

That should do the trick

[Jeff_Traigle]

A look at the find man page (available from docs.hp.com if you ever find yourself not able to login a system) shows that the -nouser and -nogroup options do exactly what you want.

[James R. Ferguson]

Hi:

# find / -nouser | xargs ls -l

# find / -nogroup | xargs ls -l

If you want to confine your search to a specific directory you should use:

# find /path -xdev | xargs ls -l

To return only files use:

# find / -type f - nouser | xargs ls -l

See the man pages for 'find(1)' for more information.

Regards!

...JRF...

[Peter Nikitka]

Hi,

to get
- a combined output of both (no)user and (no)group and
- not to get duplicate output of files missing both
- not to get listings of the content of directories found

use

find . \( -nouser -o -nogroup \) -print | xargs ls -ld

mfG Peter

[Bill Hassell]

Just a note on semantics. All files and directories have an owner and a group -- no file or directory can be created without these two numbers. However, for the convenience of us mere mortals, there are two decoder files that can be used to replace these numbers with symbolic names, namely /etc/passwd and /etc/group. So while all files and directories are really owned, the -nouser and -nogroup options in find just perform a quick lookup in these two files for each number.

Files and directories without owner/group names are sometimes caused by removing users that have scattered their files all over the system and then their login is removed. But anyone can create a file with random user and group numbers as in:

touch /tmp/dummyfile
chown 12345:12345 /tmp/dummyfile

[wip]

there are quite a number of good unix security violations scanners available .Such as Symantec Enterprise Security Manager and ISS etc are in principle accomplish this and many more like world writable files/directories/suid/sgid etc

What are you using ?

WIp