Current time: 04-23-2014, 03:10 PM Hello There, Guest! (LoginRegister)

Post Reply 
all file permissions changed to 755 -- not by me
02-18-2012, 06:55 PM
Post: #16
RE: all file permissions changed to 755 -- not by me
(02-18-2012 11:21 AM)forkosh Wrote:  Yes -- somebody else's (with root privileges) runaway cron job; that's my new best (and only) guess. Very astute of you to interpret the time that way (I'd noticed it but hadn't made anything of it). I have no cron jobs of my own, and occasionally do use find to actually find files, but never to -exec anything. So, like you said, I'd have had to "really mess up" to accidentally do anything with the observed effect, which is why I didn't feel your earlier chmod -R conjecture was very likely. Does dreamhost have any reason to go around chmod'ing bunches of files, like maybe under logs/, and maybe messed up somehow? Do they routinely run any kind of jobs at 11:00pm PST?

You were logged in at that time, though, right? So we can't rule that out, especially if the IP address at that time belongs to you.

I don't think DH's cronjobs work on the user's dir because all the logs are actually links to files in another dir. I guess they could do something like that in an emergency if an attack left a bunch of files as 777, but I would hope that they would do that conditionally, not touching files that had not been attacked. Again, though, it's just speculation.

Going with Occam's razor, if you were logged in at the time of the change, I think the likelihood is that somehow it's connected to something you or one of your apps did. Given the time, it could have been an automated process. For example, I know wordpress sets up its own cronjobs. If you have something like that running in the same user, a rouge plugin could have chmoded everything for that user.

Any plugins or the like which could have done it?
Find all posts by this user
Quote this message in a reply
Post Reply 


Messages In This Thread
RE: all file permissions changed to 755 -- not by me - bobocat - 02-18-2012 06:55 PM

Forum Jump: