Somebody deleted a folder from /opt, how to figure out which user did that?

Sayan Acharjee · 02-04-2011, 04:07 AM

Hi,
Somebody deleted a folder from /opt, now how I to know who did it? should I login to every user from root and check the history? or there is better and easy solution?

thanks

xeleema · 02-04-2011, 04:13 AM

Greetingz!
Time to play "When should I stop typing!"

Code:

for x in $(find /home -type f -name "*history" 2>/dev/null)
do
printf "===  $x\n"
strings $x | grep -i filename | sort -u
done | tee -a list_of_users_to_beat.wri && \

cat list_of_users_to_beat.wri | sort -u | \
egrep -v `logname` | \
mailx -s "Weekly Beatings List" managers@company.com

Sayan Acharjee · 02-04-2011, 04:17 AM

And what if its not there in the history? Any other way to check it?

xeleema · 02-04-2011, 04:22 AM

Well, if they did it thru samba, maybe check the Samba logs?
Just what have you looked at so far?

Sayan Acharjee · 02-04-2011, 04:25 AM

Quote:

Originally Posted by xeleema

Well, if they did it thru samba, maybe check the Samba logs?
Just what have you looked at so far?

I logged into each user and checked their history, no rm command found.

But somebody has deleted a folder named /opt/IT through ssh.
Can I check it from the log of ssh?

xeleema · 02-04-2011, 04:32 AM

Oh seriously.
As root you don't need to "su -" to each user, you can read their history files directly.
If they ssh into the system, then they use a shell. Each shell should have a history file. So it would be in their history file.
Why are you only looking for "rm"? Look for the folder name! They could have moved or copied-over the folder, or used tar or who knows what.

1) Is this a "server"?
2) Do any users have the ability to pull up a remote desktop session of this system, or can they walk right up to it and login to a GUI (like KDE & GNOME)?

If this isn't a server, drat. If it is, and you let users access a desktop....guess what? Mouse clicks aren't logged (by default).

Sayan Acharjee · 02-04-2011, 04:35 AM

Quote:

Originally Posted by xeleema

Oh seriously.
As root you don't need to "su -" to each user, you can read their history files directly.
If they ssh into the system, then they use a shell. Each shell should have a history file. So it would be in their history file.
Why are you only looking for "rm"? Look for the folder name! They could have moved or copied-over the folder, or used tar or who knows what.

1) Is this a "server"?
2) Do any users have the ability to pull up a remote desktop session of this system, or can they walk right up to it and login to a GUI (like KDE & GNOME)?

If this isn't a server, drat. If it is, and you let users access a desktop....guess what? Mouse clicks aren't logged (by default).

Ok, so what is the location of the history file? I'm afraid I don't know that.

And yes, its a server without any desktop. They are logging in with ssh only.

xeleema · 02-04-2011, 04:48 AM

Quote:

Originally Posted by Sayan Acharjee

Ok, so what is the location of the history file?

Is that your RHCE ID #? Seriously, dude, the first chunk of code in my post I gave you said;

Code:

find /home -type f -name "*history" 2>/dev/null

Quote:

Originally Posted by Sayan Acharjee

And yes, its a server without any desktop. They are logging in with ssh only.

Well thank $DIETY. Read the man page for bash and you'll find out where the shell keeps it's history files.

Sayan Acharjee · 02-04-2011, 04:52 AM

Quote:

Originally Posted by xeleema

Is that your RHCE ID #? Seriously, dude, the first chunk of code in my post I gave you said;

Code:

find /home -type f -name "*history" 2>/dev/null

Well thank $DIETY. Read the man page for bash and you'll find out where the shell keeps it's history files.

Actually, I did not go through that code. Someone has informed me that he checked and histories and found no command with that folder.

xeleema · 02-04-2011, 04:54 AM

Quote:

Someone has informed me that he checked and histories and found no command with that folder.

Yeah...the shell's log by default. Whatever $HOME is for your users, run the find command there. Don't take the PFY's word for it.

nallanisai · 02-05-2011, 10:31 PM

Hi sayan,

issue the below command to know which user executed which command

#cat /home/<user home directory>/.bash_history

It will show the user executed commands

TobiSGD · 02-05-2011, 11:42 PM

I have questions about this: On all my systems the /opt-directory is owned by root and not writable to users. If I assume that this is the same on your system then I have to assume that your users know the root-password. If they su to root with this password, is one even able to find out which user has deleted the folder, because it was root who deleted it?
Or did you change the permissions on /opt (and if so, why?)? If you have not changed the permissions, I have to ask why your users know the root-password?