LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 08-17-2009, 09:10 AM   #1
yuanjunliang
LQ Newbie
 
Registered: Apr 2009
Posts: 22

Rep: Reputation: 0
How to Find who changed /etc/hosts file


How to Find who changed /etc/hosts file?

Thanks
 
Old 08-17-2009, 09:39 AM   #2
centosboy
Senior Member
 
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by yuanjunliang View Post
How to Find who changed /etc/hosts file?

Thanks
for past -
depends how users log into your system and become root.
you could search .bash_history files, but then if the user logs in as root, then you may never know.


for future -
setting up sudo access for all users, logs all root commands by default
 
Old 08-17-2009, 10:10 AM   #3
neonsignal
Senior Member
 
Registered: Jan 2005
Location: Melbourne, Australia
Distribution: Debian Buster (Fluxbox WM)
Posts: 1,391
Blog Entries: 52

Rep: Reputation: 360Reputation: 360Reputation: 360Reputation: 360
Assuming it wasn't malicious (in which case the log files may have been changed) and was done via a user account sudo to root (or external ssh), you could examine /var/log/auth.log to see who logged in to root at the time the /etc/hosts file was last changed.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Path changed, I cant find where the problem is kramed Fedora 3 03-27-2008 02:25 PM
Hosts file has changed on installation. mooshie Fedora 2 10-16-2005 05:28 PM
find: . changed during execution of find suse degraffenried13 Linux - General 3 12-12-2004 08:13 PM
Changed modems: eth0 cant find IP address suggardaddy4242 Linux - Newbie 2 09-09-2004 12:45 PM
does the /etc/hosts file work same as the M$ hosts file? Lleb_KCir Linux - Software 6 04-03-2004 05:33 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:29 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration