Re: Group permissions changed

On Wed, Sep 28, 2005 at 06:33:24PM -0000, sf_submit@yahoo.com wrote:

> Fairly recently I noticed my ftp client wouldn't list files in certain
> directories on my server anymore - so I ssh'd in (it's dedicated), and
> did a ls -aFl on the files, hoping to see what the problem was - here
> are a few of the results:
>
> -rw-r--r-- 1 larry 503 371 2005-02-25 08:36 head.php
> -rw-r--r-- 1 larry 48 873 2005-09-09 03:23 foot.php
>
> I never set the group ids to 503 or 48, so I checked just to make sure
> - and no groups with those ids even exist. Is there an exploit/tool
> that causes this, and should I be worried?
>
> I checked the processes running, and everything seems to be OK - same
> with any processes connecting to the internet.

A remote possibility:  This is normal when the partition is an
nfs-mounted partition and the files were on the nfs-server of which the
uid's and gid's are not identical to that of the nfs-client.

Coming from an ftp-administrators who for years had to use nfs-mounted
volumes because of lack of storage space :)

Regards
Johann
-- 
*********************************************************************
 Johann Spies and Gerhard van Wageningen
 System Administrator          *   Email:   sysadm@sun.ac.za
 UNIX Systems                  *              
 University of Stellenbosch    *   Tel: (+27 21 808)4036(J) / 4554(G)
*********************************************************************