Re: Group permissions changed

From: System Administrator (sysadm_at_sun.ac.za)
Date: 09/30/05

  • Next message: Jan Slupski: "Re: Group permissions changed" 
    Date: Fri, 30 Sep 2005 08:21:54 +0200
To: focus-linux@securityfocus.com

    On Wed, Sep 28, 2005 at 06:33:24PM -0000, sf_submit@yahoo.com wrote:

    > Fairly recently I noticed my ftp client wouldn't list files in certain
    > directories on my server anymore - so I ssh'd in (it's dedicated), and
    > did a ls -aFl on the files, hoping to see what the problem was - here
    > are a few of the results:
    >
    > -rw-r--r-- 1 larry 503 371 2005-02-25 08:36 head.php
    > -rw-r--r-- 1 larry 48 873 2005-09-09 03:23 foot.php
    >
    > I never set the group ids to 503 or 48, so I checked just to make sure
    > - and no groups with those ids even exist. Is there an exploit/tool
    > that causes this, and should I be worried?
    >
    > I checked the processes running, and everything seems to be OK - same
    > with any processes connecting to the internet.

    A remote possibility: This is normal when the partition is an
    nfs-mounted partition and the files were on the nfs-server of which the
    uid's and gid's are not identical to that of the nfs-client.

    Coming from an ftp-administrators who for years had to use nfs-mounted
    volumes because of lack of storage space :)

    Regards
    Johann 

    -- 
*********************************************************************
 Johann Spies and Gerhard van Wageningen
 System Administrator          *   Email:   sysadm@sun.ac.za
 UNIX Systems                  *              
 University of Stellenbosch    *   Tel: (+27 21 808)4036(J) / 4554(G)
*********************************************************************
  • Next message: Jan Slupski: "Re: Group permissions changed"