Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My linux CentOS server has been compromised lately (rootkit). Some files attributes have been changed, for example the command :

lsattr /bin/ls


s---ia------- /bin/ls

How cand I use find command to list all files on system that have attributes set to s---ia------- instead of -------------?

share|improve this question
up vote 2 down vote accepted

Find doesn't have any way of obtaining this information directly but you don't need to use it as lsattr has a -R switch so

lsattr -R /path/you/care/about 2>/dev/null | grep -- 's---ia-------'

should do what you want.

Note the -- to grep isn't required for your specific set of attributes but if for example you wanted to search for '----ia-------' then you would definitely need it.

share|improve this answer
Works, thanks!!! – Danijel Oct 7 '12 at 16:08

Because you have mentioned about find, I am suggesting you to try following command

find / -type f -exec lsattr {} + | grep -v '\-\-\-\-\-\-\-\-\-\-\-\-\-'

Ideally, I'd prefer to use AIDE or tripwire

share|improve this answer
Doesn't work: "missing argument to -exec". – Danijel Oct 5 '12 at 10:13
I have verified and it works on CentOS 5. I forgot to mention escape character for grep though. it should be | grep -v '\-\-......' – Nehal Dattani Oct 5 '12 at 10:19
Could you edit the answer, thanks. – Danijel Oct 5 '12 at 10:27
You can use -- to indicate that there are no more options – Iain Oct 5 '12 at 10:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.