How can I audit a Linux filesystem for files which have been changed or added within a specific time

Posted by Bcos on Server Fault See other posts from Server Fault or by Bcos
Published on 2010-04-05T15:40:39Z Indexed on 2010/04/05 15:43 UTC
Read the original article Hit count: 263

Filed under:
|
|
|

We are a website design/hosting company running several sites on a Linux server using Joomla 1.5.14 and recently someone was able exploit a vulnerability in the RW Cards component to write arbitrary files/modify existing files on our filesystem enabling them to do some nasty things to our customers sites.

We have removed vulnerable modules from all sites but are still seeing some problems. We suspect that they still have some scripts installed and need a way to audit anything that has been changed or added in the last 10 days. Is there a command or script we can run to do this?

© Server Fault or respective owner

Related posts about linux

Related posts about joomla