RE: Folders Owner and permissions Changed

Well, by looking at the old permissions: you had write privileges open to
the world and it looks like someone took advantage of that. 



-----Original Message-----
From: Faisal [mailto:[email protected]]
Sent: Thursday, June 05, 2003 3:42 PM
To: [email protected]
Subject: FW: Folders Owner and permissions Changed


Hi,

I just configured a web site on my RH7.2 box running
apache-1.3.27-1.7.2.

After defining web site about 15 minutes later I found that permissions
and owner of the web site files are changed to something like this. 

drwxrwxrwx    6 544      401          4096 Jun  3 16:29 admin
-rwxr-xr-x    1 root     root        14604 Jun  4 11:48 admin.php
-rwxrwxrwx    1 544      401          2039 Sep 16  2002 auth.php
drwxr-xr-x    3 root     root         4096 Jun  4 13:14 backup
-rwxrwxrwx    1 544      401         14976 Sep 16  2002 banners.php
-rwxrwxrwx    1 544      401          2632 Sep 16  2002 footer.php
-rwxrwxrwx    1 544      401          1987 Sep 16  2002 header.php
drwxrwxrwx   14 544      401          4096 Jun  4 11:26 images
drwxrwxrwx    2 544      401          4096 Jun  3 16:29 includes
-rwxrwxrwx    1 544      401          2295 Sep 16  2002 index.php
drwxrwxrwx   28 544      401          4096 Jun  4 10:48 navigation
-rwxr-xr-x    1 root     root         4356 Jun  4 11:23 navigation.php
drwxr-xr-x    2 mysql    mysql        8192 Jun  4 13:16 sql



The old files permission was like this looking at backup copy of files.

drwxrwxrwx    6 root     root         4096 Jun  3 16:29 admin
-rwxr-xr-x    1 root     root        14604 Jun  4 11:48 admin.php
-rwxrwxrwx    1 root     root         2039 Sep 16  2002 auth.php
-rwxrwxrwx    1 root     root         4096 Sep 16  2002 backup
-rwxrwxrwx    1 root     root        14976 Sep 16  2002 banners.php
-rwxrwxrwx    1 root     root         2632 Sep 16  2002 footer.php
-rwxrwxrwx    1 root     root         1987 Sep 16  2002 header.php
drwxrwxrwx   14 root     root         4096 Jun  4 11:26 images
drwxrwxrwx    2 root     root         4096 Jun  3 16:29 includes
-rwxrwxrwx    1 root     root         2295 Sep 16  2002 index.php
drwxrwxrwx   28 root     root         4096 Jun  4 10:48 navigation
-rwxr-xr-x    1 root     root         4356 Jun  4 11:23 navigation.php
drwxr-xr-x    2 mysql    mysql        8192 Jun  4 13:16 sql

I also checked with my etc/passwd file for UID 544 and GID 401 both not
found.

I have no ftp server running on this box neither wu-ftp or ftpdpro.

It's local company site.

Any one has any idea I am feeling compromised? 

Faisal Ashraf 


_______________________________________________
enigma-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/enigma-list