Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a folder on server, which has a website in it. the server has been cutoff from the internet, but after some time, few folders are automatically created in it with some suspicious files inside each of them.

I have checked Cron jobs for all users, nothing is running through the Crons. After i tried to check the system calls to folder using Inotify tools, i got this result:

./Lq1Lbs/ MODIFY index.html
./Lq1Lbs/ CLOSE_WRITE,CLOSE index.html
./nmt08u/ MODIFY index.html
./nmt08u/ OPEN index.html
./nmt08u/ ATTRIB index.html
./nmt08u/ ATTRIB index.html
./nmt08u/ MODIFY index.html
./nmt08u/ CLOSE_WRITE,CLOSE index.html

But i need to know that which Exact utility, Script, User or what created the folders and files in it. I have already tried tripwire, ossec, AIDE, all of them Just notify of the creation/delection or modification of file, but does not tell me that Which exact script, file, script or utility did this action. Is it possible to know it?

In short, which process changed or created which file/folder, thats what i want to know. Thanks

share|improve this question
    
cyberciti.biz/tips/… –  quanta Oct 16 '12 at 14:54
add comment

3 Answers

up vote 1 down vote accepted

The only sane approach to implement that is to use the Liunx Audit Framework (LAF). Check this quick start document on how to approach your problem.

share|improve this answer
add comment

I don't know of a way to do it after the fact, but the audit daemon can trap this information.

Configure auditd to watch /etc/passwd:

auditctl -w /etc/passwd -p war -k password-file

Check to see who has modified /etc/passwd:

ausearch -f /etc/passwd -i

It's very powerful and there's a lot more to it than just the above.

Linux audit files to see who made changes to a file

share|improve this answer
add comment

One way, proposed by this Q&A on the Unix/Linux site, is to combine Linux's inotify subsystem with the lsof command. The latter lists all open file handles. If you trigger lsof as soon as the interesting file creation or modification occurs you stand a good chance of catching the culprit. There is no guarantee, however—if the process writes the file as quickly as possible and exits immediately afterward, this method won't work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.