Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have three questions related to the "ctime" information of a file. They are in bold (if you don't have time you can jump directly to them).


A website on my dedicated server has been hacked. Lots of files have been edited. I noticed that some hackers were clever enough to reset the mtime (some not).

atime and mtime can be changed with PHP functions. ctime can also be changed by using the chmod function. But ctime is handled by the kernel, so it's only possible to set it to the current system date/time. It's impossible to set it back to the past.

I found some backdoors whose mtime had been reset to the ctime (date in the past, like 1 or 2 years ago), so that I can't find it using recursive search tool based on that information.

The key to be able do find quickly all infested files is of course the ctime information. The problem is that I didn't think of it at first, so I first "chmoded" recursively all the files so that the website itself doesn't have write permissions anymore. In doing this, I lost the precious ctime information.

I have lots of backups, in form of .tar.gz files. I want to know if there is a way to extract from the tar.gz file the ctime of the files of the moment they were added the the tar.

I read the whole GNU tar documentation, and found out that the "GNU" format of tar (which is the default used by my Linux server) stores the ctime of its archived files. I tried following way to extract it:

tar -zxf Friday.tar.gz --to-command=./script

./script is a bash script and looks like this:

#!/bin/bash
echo $TAR_CTIME

The problem is that this gives the current date and time, maybe because tar gives out the informations of the file it would itself create if I hadn't used --to-command


If tar cannot handle this, is there backup tools which can keep original ctime information?


How to list every file whose mtime and ctime differ? I read the find manual but only found out the -newerXY, which (if I understand well), can only compare a ctime with a ctime, a mtime with a mtime, etc. Is there a way to compare a ctime and a mtime of the same file?

share|improve this question
    
atime-preserve is a long option, but I don't see any mention of ctime. –  user160910 Jul 2 '13 at 20:18
    
Short note: you cannot set ctimes. I wrote an article detailing such things. –  Halfgaar Jul 2 '13 at 20:18
    
Yes, I already read your article before posting here. :) There is a way to set ctime: if you are the owner of the file, you can just chmod it. This resets the ctime to the current system date. –  Fox Jul 2 '13 at 20:22
    
To catch this sort of activity, where an attacker alters file modification times, audit the utime() system call. Of course, you must have set this up before the compromise. –  Michael Hampton Jul 2 '13 at 20:22
add comment

2 Answers

Have you considered using tar compare option to see which files are changed? This should give you a quick list of candidates.

share|improve this answer
    
I haven't thought about it! But is it possible to specify a subpath of the tar archive to compare? Like tar -dvf archive.tar folder/inside/tar/to/be/compared/to/filesystem –  Fox Jul 4 '13 at 18:54
    
I believe so. Read the man page. –  BillThor Jul 4 '13 at 23:08
add comment

ctime is controlled by kernel, not any userspace tool, tar or any other program, because to back up and restore, they have to create a new inode which must have a new ctime. one known way to preserve it is to image your filesystem to a loopback file, and save that image. unless your filesystem is quite full and you do want to save the whole thing, it is quite wasteful.

there are more efficient programs such as partimage, but i have not checked if they preserve ctime of inodes.

share|improve this answer
    
I know that the creation of a new file makes a new ctime by the kernel. But since tar stores the original ctime information, would it be possible to "read in his internal data" just to get the information, without creating any file (like in the "-t" option)? –  Fox Jul 2 '13 at 20:38
    
tar does not preserve the inode so you cannot. ctime is part of the inode, which is a filesystem data structure. that is why you have to backup the entire filesystem to preserve it. i guess it is possible for a backup software to preserve it by saving the inode information, but since it cannot be used in restoring the file it is not useful and thus likely not implemented anywhere. –  johnshen64 Jul 2 '13 at 20:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.