Who is sftp-ing files to me? Is there any way to find out?

Question

I've had to take responsibility for an Ubuntu linux machine that we're using as a file server. I have almost no prior experience with Linux. One of the things I'm trying to get a handle on is a bunch of very large files that someone is transferring on to this server and eating up any available space. I've asked around and no one is using those files or knows where they are coming from. I don't want to keep logging in every day to keep deleting those files but I have no idea who to trace where they're coming from. All I know is that the files are being pushed to our server, most likely through sftp, and that we're not pulling the files from somewhere (I haven't found any cron job that does this). Is there any way for me to find out where these files are coming from and maybe block them?

Answer 1

A couple ideas:

Is there a common SFTP username and password that everyone uses to connect to the server, or does everyone have their own username? If they each have their own username, you can look at the owner of the files using ls -l path/to/file.

Since SFTP runs on top of SSH, you can check the authentication log in /var/log/auth.log to see who logged in and when. You could check the create time in the large files and see if you can correlate the create/login times. The auth.log file has the IP address and usernames of every login attempt to the machine. Once you have the IP address, you could do a reverse DNS lookup (i.e. with dig @your_nameserver -x offending_ip +short, or do any other network reconnaissance you can think of.

As far as what to do once you find out who's using up all the space, it depends on who's using your file server. If it's a public file server, banning the IP might seem reasonable, but if someone is intent on abusing your service they could just proxy through another IP and do it all again. If it's an internal file server for your organization, you probably want to talk to the offender, if you can find them. It might be worth it to draft up a simple set of rules for using the file server (i.e. don't upload huge files), and post it somewhere people can see it.

Answer 2

In general:

• Files will always have ownership details, a username and group, looking up both of which may already give information about an actual business user, a specific business process or a responsible server process
• The file location/directory path often hints at a specific service as well. I.e. Files under /var/www hint at a web server process, an online upload form or web DAV etc.
• Additionally most daemons (including sftp) will log events such as user authentication and/or uploads in /var/log which may also allow you to determine from which systems such uploads originated

Answer 3

You can use systemtap to find which PID is creating the file. Here is how to see for delete: https://serverfault.com/a/310477/30946 For create, you need to watch creat(2) and open(2) syscalls.

The systemtap script would be:

probe syscall.creat, syscall.open
{
    printf ("%s(%d) open (%s) userID(%d)\n", execname(), pid(), argstr, uid())
}