Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My linux CentOS server has been compromised lately (rootkit). Some files attributes have been changed, for example the command :

lsattr /bin/ls

gives

s---ia------- /bin/ls

How cand I use find command to list all files on system that have attributes set to s---ia------- instead of -------------?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Find doesn't have any way of obtaining this information directly but you don't need to use it as lsattr has a -R switch so

lsattr -R /path/you/care/about 2>/dev/null | grep -- 's---ia-------'

should do what you want.

Note the -- to grep isn't required for your specific set of attributes but if for example you wanted to search for '----ia-------' then you would definitely need it.

share|improve this answer
    
Works, thanks!!! –  Danijel Oct 7 '12 at 16:08
add comment

Because you have mentioned about find, I am suggesting you to try following command

find / -type f -exec lsattr {} + | grep -v '\-\-\-\-\-\-\-\-\-\-\-\-\-'

Ideally, I'd prefer to use AIDE or tripwire

share|improve this answer
    
Doesn't work: "missing argument to -exec". –  Danijel Oct 5 '12 at 10:13
    
I have verified and it works on CentOS 5. I forgot to mention escape character for grep though. it should be | grep -v '\-\-......' –  Nehal Dattani Oct 5 '12 at 10:19
    
Could you edit the answer, thanks. –  Danijel Oct 5 '12 at 10:27
    
You can use -- to indicate that there are no more options –  Iain Oct 5 '12 at 10:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.