From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefano Schiavi Subject: Re: need help interpreting ausearch results Date: Sat, 21 Dec 2013 13:48:37 +0100 Message-ID: <52B58E25.4080007@gmail.com> References: <52ACE768.7030606@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id rBLCmdJ2030662 for ; Sat, 21 Dec 2013 07:48:39 -0500 Received: from mail-ea0-f174.google.com (mail-ea0-f174.google.com [209.85.215.174]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rBLCmbVw019637 for ; Sat, 21 Dec 2013 07:48:38 -0500 Received: by mail-ea0-f174.google.com with SMTP id b10so1525220eae.19 for ; Sat, 21 Dec 2013 04:48:37 -0800 (PST) Received: from Mach.local ([95.233.63.227]) by mx.google.com with ESMTPSA id g47sm27304412eeo.19.2013.12.21.04.48.35 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 21 Dec 2013 04:48:36 -0800 (PST) In-Reply-To: <52ACE768.7030606@gmail.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hello, Could anyone help with this? I really don't know where else to ask. Thank you very much. Stefano On 12/15/13, 12:19 AM, Stefano Schiavi wrote: > Hello, > > Thank you Steve and all for keeping up the great work here. > > Some time ago I setup some audit rules to monitor what would change > the permissions of the public_html directory since we found that once > in a while it would change to 777 out of the blue. > > It happened again yesterday and I believe these parts of the log > represent when the issue happened: > > type=PATH msg=audit(1386933561.795:7958476): item=2 name="./www" > inode=4980752 dev=08:08 mode=0120777 ouid=501 ogid=501 rdev=00:00 > type=PATH msg=audit(1386933561.795:7958476): item=1 name="./" > inode=4980737 dev=08:08 mode=040711 ouid=501 ogid=501 rdev=00:00 > type=PATH msg=audit(1386933561.795:7958476): item=0 name="public_html" > type=CWD msg=audit(1386933561.795:7958476): cwd="/home/lanogbar" > type=SYSCALL msg=audit(1386933561.795:7958476): arch=c000003e > syscall=88 success=yes exit=0 a0=1306d160 a1=1306d200 a2=11 a3=0 > items=3 ppid=18728 pid=18731 auid=0 uid=501 gid=501 euid=501 suid=501 > fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=117304 > comm="gtar" exe="/bin/tar" key="lanogbar-www" > > > This is just a guess though and I can not be sure as I have no > experience parsing the logs. Looking through with the I flag we can > see the following:: > > type=PATH msg=audit(12/13/2013 15:00:03.759:7970202) : item=0 > name=/home/lanogbar/public_html/ inode=4980744 dev=08:08 mode=dir,750 > ouid=lanogbar ogid=nobody rdev=00:00 > type=CWD msg=audit(12/13/2013 15:00:03.759:7970202) : > cwd=/home/lanogbar/public_html > type=SYSCALL msg=audit(12/13/2013 15:00:03.759:7970202) : arch=x86_64 > syscall=chmod success=yes exit=0 a0=1585e520 a1=1ff a2=2f a3=146c1d40 > items=1 ppid=27717 pid=8804 auid=root uid=lanogbar gid=lanogbar > euid=lanogbar suid=lanogbar fsuid=lanogbar egid=lanogbar sgid=lanogbar > fsgid=lanogbar tty=(none) ses=117304 comm=php exe=/usr/bin/php > key=lanogbar-public_html > > Do you think this is relevant? > If so it would seem a php script was responsible. > > Would you have any suggestion on how to identify the script? > > Thank you very much for the very valuable help. > Kind regards, > Stefano