Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are seeing a very weird situation for the last 2 days. On our website - PHP/MySQL based - we have the following situation -

We have a number of directories under public_html, all owned by apache:apache. These directories have execute permission for all.

We are seeing that the permissions on these directories keep getting changed - the execute keeps getting removed. We cannot figure out why and what is doing this? Obviously, the concern is that someone is trying to alter the website, using the apache account (which is setup as a nologin account).

Any help would be appreciated.

share|improve this question

Setup auditd (as per the information given in this answer) and use it to identify what's making the change. Once you've identified what's making the change, then you can get into the more interesting problem of "how" and "why".

share|improve this answer

You can monitor directories permission with incron + inotify.

  1. Set a watch on public_html folder for auditing:

    # auditctl -w /path/to/public_html -p warx
  2. Install incron and create a configuration file to monitor all subdirectories in public_html:

    find /path/to/public_html -type d -print0 | xargs -0 -I{} echo "{} IN_ATTRIB" >> /etc/incron.d/webroot.conf including a simple line as belows:


echo "`date +%c`" | mail -s "someone has changed permission in public_html" your@email.address

Whenever someone change permission, it will email to you. Login to your server and check who has made changes with ausearch -f /path/to/public_html, you will see something like this:

time->Mon Aug  8 01:12:41 2011
type=PATH msg=audit(1312740761.563:2279002): item=0 name="/var/www/html/awstats/" inode=1732554 dev=08:03 mode=040775 ouid=48 ogid=48 rdev=00:00
type=CWD msg=audit(1312740761.563:2279002):  cwd="/var/www"
type=SYSCALL msg=audit(1312740761.563:2279002): arch=c000003e syscall=90 success=yes exit=0 a0=14cb0d0 a1=1b4 a2=ffffffb6 a3=1b4 items=1 ppid=12660 pid=12901 auid=510 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=pts1 ses=360563 comm="chmod" exe="/bin/chmod" key=(null)

Pay attention to uid and gid.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.