Date: Thu, 27 Jun 1996 14:39:34 GMT From: hal@snitt.com (Hal Snyder) To: Troy Arie Cobb <troy@circle.net> Cc: security@freebsd.org Subject: Re: Odd permission changes Message-ID: <31d29c6e.3939041@vogon.trans.sni-usa.com> In-Reply-To: <Pine.BSF.3.91.960626181341.15893A-100000@demeter.circle.net> References: <Pine.BSF.3.91.960626181341.15893A-100000@demeter.circle.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 26 Jun 1996 18:27:58 -0400 (EDT), you wrote: > I have a strange thing that's been happening regularly now, > following an incident w/ a cracker-type (who is now long > gone). Now, on Fridays, around 2am, all of the owner-execute > permissions on all files is removed. This has happened two > weeks in a row now, I have accounting active and saw the > chmod, but no one was logged in, and the daily/weekly scripts > don't have any chmods in them. If searches of cron and at tables don't help, I'd hack the kernel to track chmod calls to syslog, including timestamp, real userid, and program name.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?31d29c6e.3939041>