Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Short intro: I have a box with FreeBPX (Centos 5.4) on it. Due to an exploit a user got access to the Web UI and was able to collect trunk usernames and passwords.

My main questions is as follow, the user did not gain root access. Now for the investigation I am left with the access_log from Apache http server, so I need to know am I investigating on valid files.

My question would be, is it possible that the user altered the Apache logs without the root access. Apache created several files over time so I have access_log.1 access_log.2 ... each file seems valid to me and the created dates seems to be valid.

Can I rely on those files. Is there a known vulnerability that Apache's access_log can be compromised without the root access?

share|improve this question

1 Answer 1

This question is a bit tricky to answer because we'd had to make too many assumptions. I have a couple more questions for you to answer:

  • How do you know that a user hacked the website?
  • How do you know that he didn't get root access?
  • What permissions is Apache http server using?

In theory if you don't have an IDS, like AIDE, you can't be sure about which files were altered and which not, because there are 0day exploits that we don't know about. So Apache might be vulnerable, only users watching closely the apache mailing list know of bugs/issues that are not closed yet ( see here ).

So if you don't share more info, it's hard to tell. Generally speaking though, if you are 100 sure that root access was not compromised and apache was not hacked then he can't read the files.

If the user used and Apache bug to hack apache then the shell has 'www' privs which means he can read/alter those files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.