Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Debian Squeeze once a day the home directory permissions of one specific user get resetted to chmod 700 and chown root:root. Every day I have to set the permissions manually to login properly. Anyone got an idea where this comes from?

share|improve this question
    
What's the name of the user? Maybe it is a "special" name like "www-data" or something like that. Does it have a uid of less than 1000? –  Shi Aug 16 '12 at 20:11
    
Is the home directory in /home/? –  DerfK Aug 16 '12 at 20:30
3  
Look at /etc/crontab,/etc/cron.(d|daily)/*, /var/spool/cron/crontabs/*. Are you sure you don't have anything setup to reset permissions? Do you have a configuration management system like puppet|chef|etc updating things? –  Zoredache Aug 16 '12 at 21:33
    
It's a custom user just to avoid root login. Yes it's in /home/ directory. I was hoping this may be a common problem or bug to avoid looking through all the cron scripts. –  Flexx Aug 17 '12 at 20:11
add comment

1 Answer 1

Install audit package:

Name       : audit
Arch       : x86_64
Version    : 1.7.13
Release    : 2.el5
Size       : 898 k
Repo       : installed
Summary    : User space tools for 2.6 kernel auditing
URL        : http://people.redhat.com/sgrubb/audit/
License    : GPL
Description: The audit package contains the user space utilities for
           : storing and searching the audit records generate by
           : the audit subsystem in the Linux 2.6 kernel.

Set a watch on /home/user for auditing:

# auditctl -w /home/user/ -p war

When the permission changes, you can find out who did it by running:

ausearch -f /home/user/

Example output:

time->Fri Sep  7 01:13:03 2012
type=PATH msg=audit(1346955183.879:429844): item=0 name="/home/user/" inode=849480 dev=03:03 mode=040700 ouid=0 ogid=500 rdev=00:00
type=CWD msg=audit(1346955183.879:429844):  cwd="/root"
type=SYSCALL msg=audit(1346955183.879:429844): arch=c000003e syscall=90 success=yes exit=0 a0=1303b0b0 a1=1e8 a2=1e8 a3=1e8 items=1 ppid=17909 pid=25018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="chmod" exe="/bin/chmod" key=(null)
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.