0

I'm on a Linux-like sysop running several websites.

How can I find out the creator of a file? E.g.: uploaded via FTP, created by shell, uploaded with an HTML form, ecc?

Thanks everybody!

  • Get it from the logfiles. – ott-- Apr 27 '15 at 19:33
0

You can't easily see where a file is coming from unless you got decent logging of everything that can potentially create files. In the filesystem, you only see who created a file and when, but not by what means, unless maybe you're using e.g. a very tight configured selinux, but I don't know much about that.

The basics:

  1. The file is written by some process.
  2. The process runs under a certain user id. That's it.

For a webserver for example there can be several cases: It can run entirely as one user (e.g. nobody, www, ...) or as one user per site (using suexec). The same is true for PHP potentially being run by the webserver, it can be run as a webserver module, via CGI, ...., each of those cases is different. I will refrain from discussing here what would be the best way to run it.

When you're talking about HTML forms, the form itself doesn't do anything. Maybe you should do some reading about that. The data is merely transferred to the server and then processed by some form of script (like PHP, see above). Whatever script run via your webserver creates files, the script itself should contain appropriate logging.

FTP is pretty much the same thing as the webserver. Either you're an anonymous user, if you allow anon uploads at all, or you're logged in as a specific user, in which case the file will be stored by that user id and there will be a trace in the ftpserver logs.

So unless you know exactly what's going on on your machine, and even then, tracing file origins will be a hard task.

I won't address file creation via shell. If you have shell users, you should already know what you are doing, and probably you wouldn't be asking this question. ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.