permissions on /usr/bin/compress

[kdc]

For the past two nights the permissions on /usr/bin/compress have been changing to 500 from 555. Does anyone have any suggestions on how I could track what has been performing this change. I have checked the .sh_history and have talked with numerous people asking if there have been any changes on the system.

[Wodisch_1]

Hey Joe,

seems to be a "crontab" job running wild - what's in your "root" crontab?
Or does your "bin" have a crontab?
Weel, check the command lines or scripts run from those crontabs for "chown" commands...

HTH,
Wodisch

[Wodisch_1]

Hey Jagain,

and check all your smybolic links - maybe one of those is pointing to your "/usr/bin/compress"?

find / -type l -exec ls -abdl {} ";" | grep compress

HTH,
Wodisch

[Wodisch_1]

me again,

sorry for the typos - I am a little distracted by my job ;-)
Use the "change date" of "/usr/bin/compress" to learn WHEN this "chmod" happens (yes, it should be "chmod", not "chown"). Use "ls -lc /usr/bin/compress".

regards,
Wodisch