Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are a website design/hosting company running several sites and someone was able to write arbitrary data to the file system. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?

share|improve this question

6 Answers 6

up vote 11 down vote accepted

Start Over:
Personally, I would have trouble sleeping at night unless I just rebuilt each sever from a fresh install.

I recommend strongly you do this, hackers can hide things, and make them look like they have changed even if they have if they are good enough.

Why find won't work:
For example, to change the modification time:

kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22 foo
[kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo  
[kbrandt@kbrandt: ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 1998-12-13 05:30 foo

ctime might be better to search for if you go the find route, but there may be an easy way to change that as well. If not easy, someone could go in and just edit the filesystem itself with the device I imagine.

Just found the following online with ctime, haven't tried it though:

Since ctime is the last time the inode info was changed, you could
change the system date, make a new hardlink, remove it again and change
the date back.

And this stuff is only using tools that are already on the system in userland, forget what someone could do if they are proficient in kernel programming.

share|improve this answer
    
We are leaning towards this. –  coconut_pete Apr 5 '10 at 16:06
    
+1 - doesn't answer the question, but gives the better long-term advice. –  Zayne S Halsall Apr 5 '10 at 17:21
    
Zayne: Ya, Ignacio had already posted his answer so no point in repeating it.... I will update with how simple it is to change mtime to give a little more substance to the answer. –  Kyle Brandt Apr 5 '10 at 17:26
    
+1, agreeing with Kyle, the real answer is not cleaning, it's nuking. serverfault.com/questions/6190/… A half-way decent rootkit will hide itself from all attempts at detection. –  Avery Payne Apr 5 '10 at 17:28
    
I am considering this the best answer. –  coconut_pete Apr 5 '10 at 17:39

as sinping pointed out "tripwire" should be your answer to the problem you are facing. It is an wonderful tool to do a file system audit and five much more insight into it.

share|improve this answer

Dnotify might be interesting for you as well: http://en.wikipedia.org/wiki/Dnotify

share|improve this answer

Find is probably your best bet at this point, but I would agree with the fresh installs. However, how do you know your database wasn't compromised as well?

Most applications like Joomla can benefit from locking down the file permissions. I doubt your web server needs write access to all of the files/directories in the tree. You should make them read only except where needed.

Going forward, might I suggest you run some form of IDS such as tripwire (http://sourceforge.net/projects/tripwire/) or aide (http://www.cs.tut.fi/~rammer/aide.html).

share|improve this answer

Helpful bit of advice -- if you can't avoid Joomla (or the 3rd-party add-ons, which are the biggest offenders), I would highly recommend staying up-to-date on the known exploits out there and disable add-ons as necessary:

http://www.exploit-db.com/list.php?description=joomla&author=&platform=&type=&port=&osvdb=&cve=

share|improve this answer

The find command with the -mtime and -mmin predicates can do this.

share|improve this answer
    
+1 - actually answers the OP's question. –  Zayne S Halsall Apr 5 '10 at 17:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.