Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a centos 4 linux server; Three people have the root's password including me.

When I logged on the server and switched to root today, I found that the directory /root has gone...

How can I recover my /root directory and find out who deleted it ? Is there any way that I can know who logged on the server and the every changes they made ?

Really thanks for any response.

share|improve this question
    
Just to be sure, check 'mount' and make sure someone didn't mount an empty directory over the real one. –  gbarry Jan 5 '10 at 7:50
add comment

5 Answers

up vote 5 down vote accepted

recovery: I have no idea, sorry. You can assume I made some snippy comment about how you should have backups ;)

who dun it: Assuming everyone is accessing the machine remotely (preferably via ssh) then last should tell you the IP address and username of the last people to log on.

misc: When you say 3 people have the root password: could I recommend (if you aren't already doing so) that you set PermitRootLogin no in the sshd.conf file and just make sure these 'admins' ssh as their own account and then use su. This gives you both another layer of security as well as some more logging info (rather than just the IP address 'root' connected from, you'd see Jon ssh into the server and then take root privileges.

share|improve this answer
    
Thanks a lot for your advice. Another question is that: I found that two people logged on the server yesterday, however, how can I discover who deleted the directory and what commands they had run? Is there any log I can check for thant ? Thanks:) –  bluesea007 Jan 5 '10 at 6:31
    
I don't think you can if they were logged on as root. If they were logged on as a regular user you could just check their .bash_history (home folder). –  Kiwi Jan 5 '10 at 7:41
    
If people were logged in as root, all you can trace it back to is "root did it". Unless you use lastlog and last to try narrowing down the time they were logged in, then cross-reference it with the logs in /var/log saying what IP people logged in from (if from SSH) to try narrowing it down from that to what domain they were logging in from. Generally if this if you're sharing admin privs with others, you should consider a secure secondary logging server to which logs are echoed, since an admin can easily doctor or alter records on the local machine once "owned". –  Bart Silverstrim Jan 5 '10 at 12:45
add comment

Ask them. If they can't be trusted to answer questions about what they've done on the machine, they can't be trusted with root access.

share|improve this answer
    
+1 -either that, or they are completely trustworthy, just incredibly inept. –  BuildTheRobots Jan 6 '10 at 14:29
    
If they're inept they can't be trusted with root, either. –  womble Jan 7 '10 at 0:08
add comment

Run this command as root:

root@host:/# grep rm /var/log/audit/audit.log

A lot of information is stored in /var/log/, and the audit log was useful to me.

share|improve this answer
    
Audit log will exist only if some software is creating it. –  petrus Sep 15 '12 at 19:48
add comment

For recovery try Test Disk

share|improve this answer
add comment

If there are more people knowing the root password, that still doesn't mean that it was one of them. If your server is exposed to the Internet and is not updated with security patches, it could have been owned.

A good practice for debugging such issues is to set up remote logging. If an attacker gains control and does bad things, he can't wipe the logs to cover himself, because they aren't stored on the same computer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.