How can I audit a Linux filesystem for files which have been changed or added within a specific time

Posted by Bcos on Server Fault See other posts from Server Fault or by Bcos
Published on 2010-04-05T15:40:39Z Indexed on 2010/04/05 15:43 UTC
Read the original article Hit count: 258

Filed under:

linux

|

joomla

|

security

|

filesystems

We are a website design/hosting company running several sites on a Linux server using Joomla 1.5.14 and recently someone was able exploit a vulnerability in the RW Cards component to write arbitrary files/modify existing files on our filesystem enabling them to do some nasty things to our customers sites.

We have removed vulnerable modules from all sites but are still seeing some problems. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?

© Server Fault or respective owner

Related posts about linux

apt-get install and update fail

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I've got a problem with apt-get update and apt-get install ... commands . every time update or installing fails and errors are : Get:1 http://dl.google.com stable Release.gpg [198B] Ign http://dl.google.com/linux/chrome/deb/ stable/main Translation-en_US Get:2 http://dl… >>> More
kernel module compiling error

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
sh@ubuntu:/home/ccpp/helloworld$ make gcc-4.6 -O2 -DMODULE -D_KERNEL_ -W -Wall -Wstrict-prototypes -Wmissing-prototypes -isystem /lib/modules/`uname -r`/build/include -c -o hello-1.o hello-1.c hello-1.c:4:0: warning: "MODULE" redefined [enabled by default] <command-line>:0:0: note: this is… >>> More
Build-Essentials installation failing

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am having trouble accessing the several critical header files that show to be a part of the build process. The "Ubuntu Software Center" shows "Build Essentials" as installed: Next I did the following two commands, which did not improve the problem: ~$ sudo apt-get install build-essential [sudo]… >>> More
Updating Debian kernel

as seen on Super User - Search for 'Super User'
I'm trying to update my Debian machine to 2.6.32-46 (which is the new stable). However, after doing apt-get update my apt-cache search linux-image shows me: linux-headers-2.6.32-5-486 - Header files for Linux 2.6.32-5-486 linux-headers-2.6.32-5-686-bigmem - Header files for Linux 2.6.32-5-686-bigmem linux-headers-2… >>> More
Serial connection over a single USB cable (Windows to linux, or linux to linux)

as seen on Server Fault - Search for 'Server Fault'
I'm helping out with a project for an embedded device that only has USB and no serial. This device is running Linux. These days, when we need to connect to a serial port on a device we typically use a USB to serial adapter (on something like a phone system or a load balancing device, etc). I would… >>> More

Related posts about joomla

Hire Expert Joomla Developers For Best Joomla Web Development

as seen on Ezine Articles - Search for 'Ezine Articles'
With the introduction of new tool like Joomla CMS it has become easier to build websites without any difficulty. Joomla can offer you a dynamic website with robust content management system, but at the same time hiring expert Joomla developers can further let you get a professional, attractive and… >>> More
Joomla "online-order" component for Joomla

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello Word :) Somebody can help me in finding an "online - ordering" component for joomla . That can contain the following function : Possibility of creating Form with pages like RS!Form Uploading Files Supporting Payment Gateways like PayPal , MasterCard , WebMoney , YandexMoney ,Money Bookers… >>> More
joomla: editing the mvc package for joomla component development

as seen on Stack Overflow - Search for 'Stack Overflow'
hi! i m new to joomla component development i hv just downloaded bunch of files from some jooomla mvc generater website.which llok like smthng like this hello.xml - frontend/index.html - frontend/hello.php - frontend/controller.php - frontend/models/index.html - frontend/models/hello… >>> More
Joomla, Joomla 1.5, Mambo or Drupal?

as seen on Ezine Articles - Search for 'Ezine Articles'
I won't be commenting here on which one is the best. Every web developer has his/her own preferences and likes. Joomla 1.5 being my favorite isn't bound to be yours as well. >>> More
Joomla: Warning: strpos() [function.strpos]: Empty delimiter in [installdir]\libraries\joomla\enviro

as seen on Stack Overflow - Search for 'Stack Overflow'
After installing Joomla 1.5.x on an IIS 7, instead of seeing the expected sample data I see an un-styled (sample data) page and this message at the very top of the page: Joomla: Warning: strpos() [function.strpos]: Empty delimiter in [installdir]\libraries\joomla\environment\uri.php on line 162 How… >>> More