UNIX for Dummies Questions & Answers

Can any one tell me is there any command to find out who changed the permission of a file Or is there any log file so that i can find out who has changed the permission of a file?

Thanks in Advance

The absolute way to know is to configure auditing.

You might be able to examine at the file ctime(change time) and correlate that timestamp to the lastlog, wtmp, etc.. I would provide example commands but you don't mention which UNIX variant your using. It varies by system.

Not really. You have to have already turned on auditd before the problem.
Read up on auditing, turn it on today, and then you can answer these kinds of questions in the future.

Am using HP-UX but as of now we have not configured auditing is there any other ways to find out the solution?

There is NO smoking gun in UNIX without auditing. Period. Frank gave you a way to guess. Guess means just that - take a stab based on circumstantial evidence.
Step 1:

Code:

ls -lc file_in_question

This gives you the exact time of the incident, unless you have already set permissions back to what they are supposed to be.

Assuming this time is really correct try to correlate that with who was logged in at that time. If you are very lucky only one person was logged in. Otherwise you get to guess who did it. How to do this?


Try:

Code:

last | more

This lists who has logged in and when they logged out. Since the the system was rebooted, in the order of newest to oldest. You can see the timestamp on the file, you can see who was connected to the system at that time. That is the best you can do. Right now. Enable auditing. Then you are covered from now on.

Thanks for your quick reply.
And yes i will enable auditing from now on.
I will try to find out now as you suggested hope so i will get some good results out of it.
And it would be of great help if you can help me out with find command to findout the scripts containing "chown" Command?

Code:

find / -name '*sh' -type f  \( -perm -001 -o -perm -01 \) grep -l chmod {} \;

This assumes all of your scripts are named: xxxxx.sh or xxx.ksh with a sh ending. Change that to meet your needs. the -perm subcommands check for the file to be executable by either group or world (other). You can remove both of them \( ... to ... \) if you want.