Forum Moderators: phranque

Message Too Old, No Replies

Cannot Chage File Permission as Root

         

Naveenn

9:55 am on May 10, 2009 (gmt 0)

10+ Year Member



Hi,

A file on one of my sites called redirect.php was working fine untill I got a php error and found out that the permission was strangely changed to 000 from 666 and now I cannot read/write/edit/delete this file as owner or even as root.

What could have caused this and how can I delete/replace the file? chown, chmod, rm and mv nothing works with any user.

[edited by: Naveenn at 9:56 am (utc) on May 10, 2009]

jdMorgan

2:37 pm on May 10, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> strangely changed

I'd suggest that you contact your host, and ask them to investigate how your server got hacked... because that is a distinct possibility here...

Be sure that all scripts (such as forum, blog, CMS, and database scripts) are patched to the current revision, and be sure that any scripts that you wrote perform strict input validation based on what they are willing to accept, rather than trying to predict and prohibit everything that they might want to reject.

It would be a good idea to make a complete backup of your server files, in case your host accidentally or intentionally deletes something important while trying to fix this problem. However, be aware that some of these files may have been modified (hacked), and examine them very carefully before using any of these backups to restore your server.

Jim

Naveenn

2:59 pm on May 10, 2009 (gmt 0)

10+ Year Member



But the owner of the file is still the user and not a third user and the modified date is 2 years back. The content of the file can be seen through pico and is fine. Altho, I cannot save or write to the file for some reason. Not as the user or even as root.

Naveenn

3:05 pm on May 10, 2009 (gmt 0)

10+ Year Member



ok, got it deleted.

This is the reply from support.

Hello,

Looks like the file was just chattr'd to only be appendable. I removed that attribute, and you should be able to remove it now.
____________________
David

Can someone explain the above?