0

I see my file permissions are changing automatically , to test I have kept the permssions chmod 750 to all alert file in /var/log/snort-* after some time when alert file updated the permission got changed automatically please seethe bold ones below

find /var/log/ -name "alert" | xargs ls -ltr
-rw-r----- 1 root  root          0 Jan  2 20:31 /var/log/snort/alert
-rwxr-x--- 1 snort snort  34072366 Feb  1 16:27 /var/log/snort-28/alert
-rwxr-x--- 1 snort snort  75063436 Feb  1 16:27 /var/log/snort-19/alert
-rwxr-x--- 1 snort snort  16311468 Feb  1 16:27 /var/log/snort-30/alert
-rwxr-x--- 1 snort snort  79884541 Feb  1 16:27 /var/log/snort-16/alert
-rwxr-xr-x 1 snort snort 104905721 Feb  1 16:27 /var/log/snort-1/alert
-rwxr-x--- 1 snort snort  34544347 Feb  1 16:27 /var/log/snort-24/alert
-rwxr-xr-x 1 snort snort  93270532 Feb  1 16:27 /var/log/snort-0/alert
-rw------- 1 snort snort    398030 Feb  1 16:27 /var/log/snort-27/alert
-rwxr-x--- 1 snort snort 124223452 Feb  1 16:27 /var/log/snort-8/alert
-rwxr-x--- 1 snort snort  70808479 Feb  1 16:27 /var/log/snort-5/alert
-rwxr-x--- 1 snort snort  36275553 Feb  1 16:27 /var/log/snort-15/alert
-rwxr-x--- 1 snort snort  17365347 Feb  1 16:27 /var/log/snort-9/alert
-rwxr-x--- 1 snort snort 112000757 Feb  1 16:27 /var/log/snort-12/alert
-rwxr-x--- 1 snort snort  57244741 Feb  1 16:27 /var/log/snort-4/alert
-rwxr-x--- 1 snort snort  33943973 Feb  1 16:27 /var/log/snort-7/alert
-rwxr-x--- 1 snort snort   7480744 Feb  1 16:28 /var/log/snort-11/alert
-rwxr-x--- 1 snort snort 120967271 Feb  1 16:28 /var/log/snort-21/alert
-rwxr-x--- 1 snort snort  39321621 Feb  1 16:28 /var/log/snort-13/alert
-rwxr-xr-x 1 snort snort  78907524 Feb  1 16:28 /var/log/snort-2/alert
-rwxr-x--- 1 snort snort 120505554 Feb  1 16:28 /var/log/snort-10/alert
-rwxr-x--- 1 snort snort 123510708 Feb  1 16:28 /var/log/snort-22/alert
-rwxr-x--- 1 snort snort  37705193 Feb  1 16:28 /var/log/snort-20/alert
-rwxr-x--- 1 snort snort  17115219 Feb  1 16:28 /var/log/snort-6/alert
-rwxr-x--- 1 snort snort  19318806 Feb  1 16:28 /var/log/snort-23/alert
-rwxr-x--- 1 snort snort  11678050 Feb  1 16:28 /var/log/snort-14/alert
-rw------- 1 snort snort   2813938 Feb  1 16:28 /var/log/snort-18/alert
-rwxr-x--- 1 snort snort  11182293 Feb  1 16:28 /var/log/snort-3/alert
-rw------- 1 snort snort   2231847 Feb  1 16:28 /var/log/snort-29/alert
-rwxr-x--- 1 snort snort  38157904 Feb  1 16:28 /var/log/snort-25/alert
-rwxr-x--- 1 snort snort  20220138 Feb  1 16:28 /var/log/snort-26/alert
-rwxr-x--- 1 snort snort 122715343 Feb  1 16:28 /var/log/snort-17/alert
-rwxr-x--- 1 snort snort 120842518 Feb  1 16:28 /var/log/snort-31/alert

[root@jumpo1 snort-1]# grep snort /etc/group
snort:x:40000:logstash,root

Any clue why this is happening how to preserve permssions I want to be keep chmod 750 to all alert files, no one should change that even root.

I am using linux version

[root@jumpo1 snort-1]# uname -a
Linux jumpo1 3.10.0-514.el7.x86_64 x86_64 x86_64 x86_64 GNU/Linux

  • many services at restart/reload or refresh ... puts theirs own permissions... in particularity on /var/log & /var/lib ...maybe it is similar here... – francois P Feb 1 '18 at 8:32
  • 1
    Possible duplicate of Permission Issue Snort – Kusalananda Mar 4 '18 at 18:57
  • This one at least has answers: that one hasn't any at this time. – telcoM Mar 5 '18 at 6:13
0

I can give you a temporary solution meanwhile you found the reason, you can put a cron to change the file permissions.

crontab -e

and then

* * * * * chmod 750 /var/log/snort-*
| improve this answer | |
0

Most probably logrotate is the culprit. Check /etc/logrotate.d for a configuration file that deals with the snort logs. In there, you can specifiy the access rights you prefer. But if the problem is with new logs, then you can set the umask before snort is started.

| improve this answer | |
  • It is the problem with updates if the file get updated it looses the permissions. – chandu Feb 1 '18 at 10:02
  • In the list you gave, the modification time of all files was very recent, but only three of them you marked bold. – Gerard H. Pille Feb 1 '18 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.