Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are seeing a very weird situation for the last 2 days. On our website - PHP/MySQL based - we have the following situation -

We have a number of directories under public_html, all owned by apache:apache. These directories have execute permission for all.

We are seeing that the permissions on these directories keep getting changed - the execute keeps getting removed. We cannot figure out why and what is doing this? Obviously, the concern is that someone is trying to alter the website, using the apache account (which is setup as a nologin account).

Any help would be appreciated.

share|improve this question
add comment

2 Answers

Setup auditd (as per the information given in this answer) and use it to identify what's making the change. Once you've identified what's making the change, then you can get into the more interesting problem of "how" and "why".

share|improve this answer
add comment

You can monitor directories permission with incron + inotify.

  1. Set a watch on public_html folder for auditing:

    # auditctl -w /path/to/public_html -p warx
    
  2. Install incron and create a configuration file to monitor all subdirectories in public_html:

    find /path/to/public_html -type d -print0 | xargs -0 -I{} echo "{} IN_ATTRIB sendmail.sh" >> /etc/incron.d/webroot.conf
    

sendmail.sh including a simple line as belows:

#!/bin/bash

echo "`date +%c`" | mail -s "someone has changed permission in public_html" your@email.address

Whenever someone change permission, it will email to you. Login to your server and check who has made changes with ausearch -f /path/to/public_html, you will see something like this:

time->Mon Aug  8 01:12:41 2011
type=PATH msg=audit(1312740761.563:2279002): item=0 name="/var/www/html/awstats/" inode=1732554 dev=08:03 mode=040775 ouid=48 ogid=48 rdev=00:00
type=CWD msg=audit(1312740761.563:2279002):  cwd="/var/www"
type=SYSCALL msg=audit(1312740761.563:2279002): arch=c000003e syscall=90 success=yes exit=0 a0=14cb0d0 a1=1b4 a2=ffffffb6 a3=1b4 items=1 ppid=12660 pid=12901 auid=510 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=pts1 ses=360563 comm="chmod" exe="/bin/chmod" key=(null)

Pay attention to uid and gid.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.