Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

which IP

Posted on 2014-02-12
7
Medium Priority
?
295 Views
Last Modified: 2014-02-16
Dear Experts,

Is it possible to know which IP address modified a script file in Solaris?

Thanks,
0
Comment
Question by:oamal2001
  • 4
  • 2
7 Comments
 
LVL 38

Expert Comment

by:Gerwin Jansen, EE MVE
ID: 39852894
Files are modified by users, not IP addresses.

In case you have logging enabled that shows you when a user logged on from which IP address then you could match the time stamp of the file to that of the logon time.

But if you have multiple logons at the same with the same user-id (functional use) then this will be impossible.
0
 
LVL 8

Accepted Solution

by:
Pepe2323 earned 2000 total points
ID: 39854088
That can be a real challenge, all depends of how many user access to your server

if i ware you i will try first check when this script was changed

ls -lc or ls -ltr filename -- you will get the date and time of the last change of that filename

you will need to try to match that time with user connected at that time

last  command can help you but if you have many connections at that time well, this will be difficult

My guess is that script only a few persons have rights to modify it i guess  -- example if its a  script that only root can modify then means not all user have root account ( i hope so )

i hope remote access to the server with root account is not allowed

You policies on that server can make this research  more simple or something impossible.

Regards.
0
 
LVL 38

Expert Comment

by:Gerwin Jansen, EE MVE
ID: 39862407
@oamal2001 - Can you elaborate on how the solution you've selected solves your question?
0
2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

 

Author Comment

by:oamal2001
ID: 39862417
I checked when the file last modified , checked who were logged in at that time and matched that time with user connected at that time
0
 
LVL 38

Expert Comment

by:Gerwin Jansen, EE MVE
ID: 39862422
@oamal2001 - Ok, so you got an answer to which user modified the file. That is an answer to a different question (Who modified ... instead of Which IP modified ...), I suggest that you have this question deleted.
0
 

Author Comment

by:oamal2001
ID: 39862427
You are right I needed from the beginning the IP address , but it happen that modification of the file were on a time only one user logged to the system and because I'm not familiar with UNIX administration I did not think about the time of modification.
0
 
LVL 38

Expert Comment

by:Gerwin Jansen, EE MVE
ID: 39862682
Ok, you've got your answer in the end, I'll just make sure this question is removed from search results. Thanks.
0

Featured Post

The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Experts Exchange expands question security options for members.
When you put your credit card number into a website for an online transaction, surely you know to look for signs of a secure website such as the padlock icon in the web browser or the green address bar.  This is one way to protect yourself from oth…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question