Files Automatically Changing Permissionssdsds
hello,
I’m running apache 2.2.24 and php 5.2.17. The web site that it’s service turns into a 403 Forbidden error every 5 minutes literally. I’ve found that doing a chmod -Rv 775 on the web root restores the site. However this is a band-aid and no real solution.
I’ve combed through all the cron jobs in /var/spool/cron both on this machine and the one it was recently transferred from. And I can find absolutely NO evidence of any rsync jobs or chowns or anything similar that could be affecting that directory.
What I need to do is to figure out how to determine what exactly is changing the permissions on that directory’s files so that I can put an end to it. Right now I have a chown -Rv 775 running on the directory every 5
minutes. But that is just going to contribute to load and can’t be a permanent solution.
The directory in question is on an NFS share. However I am unsure of that being the cause.
I’m afraid that I am at a loss for troubleshooting steps here. Can someone please help me find some ways to track this down and put an end to this?
Thanks Tim
5 thoughts on - Files Automatically Changing Permissionssdsds
I believe auditctl could help:
<https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Defining_Audit_Rules_and_Controls.html>
<http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html>
Barry
Thanks Barry.. I’ll five this a try
HI Barry,
Ok well the permissions change happened again! And this time I was able to capture some output thanks to your helpful tip on how to handle the situation.
However I’m not sure how to interpret the output I got and was wondering if I could have some help with that.
time->Wed May 28 22:59:43 2014
type=PATH msg=audit(1401332383.684:68621): item=0 name=”/var/www/
design.mywebsite.com/htdocs/.htaccess” inode
Thanks. Very useful. I learned something new today :-)
So you have setroubleshoot installed?
mark, afraid of more selinux crap….