permissions on /usr/bin/compress

[kdc]

For the past two nights the permissions on /usr/bin/compress have been changing to 500 from 555. Does anyone have any suggestions on how I could track what has been performing this change. I have checked the .sh_history and have talked with numerous people asking if there have been any changes on the system.

my email is kim.chester@gwl.ca

[Darren Prior]

Hi Joe/Kim,

If it's a trusted system then this is just what auditing is for. moddac is the event that you should monitor - check manpage for audevent(1M) for further info. There's also documentation for auditing on docs.hp.com

Otherwise, perhaps you should check whether any cronjobs are using compress and investigate those. Are you able to track the exact time that this occurs?

regards,

Darren.

[kdc]

I have checked all the crons for root, there are none for bin. No luck. I have also gone through the other suggestions with no luck, I am going to create a script to monitor the time it changes, this may help me narrow it down. Thanks for your help everyone. Keep the suggestions coming if anyone else can think of anything.

[Patrick Wallek]

A couple of other ways to monitor it:

# ps -ef | grep compress > /tmp/compress.log

You could script it and have it run every couple of seconds, but you are still taking a chance that you'll miss whatever it is that is changing permissions.

You could also temporarily move the chmod executable to chmod.orig and then have a custom chmod script that looks at the user invoking it, and writes all the information to a log file. Something like:

date >> /tmp/log
echo $LOGNAME >> /tmp/log
ps -ef | grep $LOGNAME >> /tmp/log

Something to help you trace who's doing this for you.