How to Find who changed /etc/hosts file

yuanjunliang · 08-17-2009, 08:10 AM

How to Find who changed /etc/hosts file?

Thanks

centosboy · 08-17-2009, 08:39 AM

Quote:

Originally Posted by yuanjunliang

How to Find who changed /etc/hosts file?

Thanks

for past -
depends how users log into your system and become root.
you could search .bash_history files, but then if the user logs in as root, then you may never know.

for future -
setting up sudo access for all users, logs all root commands by default

neonsignal · 08-17-2009, 09:10 AM

Assuming it wasn't malicious (in which case the log files may have been changed) and was done via a user account sudo to root (or external ssh), you could examine /var/log/auth.log to see who logged in to root at the time the /etc/hosts file was last changed.