Find Out Who Accessed A File

Home » CentOS » Find Out Who Accessed A File
CentOS 5 Comments

Hey guys,

Is there any way to find out the last user to access a file on a CentOS
6.5 system?

Thanks Tim

5 thoughts on - Find Out Who Accessed A File

  • Unless you’re using auditd (or a similar service) to watch the file, no. You could probably use the logs and `last` to see who was logged in at the time and make a guess.

  • Also, you can look into shell history files (though that might be cleaned by users). Admin is allowed to do that when investigates incident.

    One more thing: if “access” constitutes execution of that file, you can use lastcomm (if process accounting is enabled on the system). This only tells you the command name (not its arguments….) – so if your file is command and you are interested who executed it and when lastcomm is your friend.

    Good luck!

    Valeri

    ++++++++++++++++++++++++++++++++++++++++
    Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247
    ++++++++++++++++++++++++++++++++++++++++

  • Hey guys,

    Unless you’re using auditd (or a similar service) to watch the file, no. You could probably use the logs and `last` to see who was logged in at the time and make a guess.

    Also, you can look into shell history files (though that might be cleaned by users). Admin is allowed to do that when investigates incident.

  • If it is php script that runs by web server then the user web server daemon runs as will be the one who needs access. On CentOS with apache web server it is usually unprivileged user “apache (as apache starts as privileges user root to read certificate secret key, then drops privileges). You need to have file in question be readable as apache. Easy debugging would be: get root shell, then

    su – apache cat /path/to/file/in/question

    (assuming it is ASCII text file). One other thing I would try: disable selinux, and see if that lets apache read file, e.g.:

    setenforce 0

    Also: posting relevant “access denied” lines from web server logs may help other to spot something.

    Valeri

    ++++++++++++++++++++++++++++++++++++++++
    Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247
    ++++++++++++++++++++++++++++++++++++++++

  • Setting SELinux to permissive temporarily is a good start, although it’s also helpful to check the audit logs, with:

    ausearch -m avc -ts today

    …to see if SELinux prevented access today. It’s quite likely SELinux preventing access, particularly if you’re using PHP to read a file that’s not in one of the standard WWW paths that the web server is allowed to access. SELinux prevents the web server from reading, writing or executing files outside of a fairly select few locations.