Unix: Looking at files this way and that

Unix systems as part of the base OS have a number of commands that can help you characterize files that strike you as suspicious. Even without a file integrity scanner, you can make some headway toward identifying the nature of files on your system.

find

The find command can find files that have been changed within so many days or that are newer than some reference file, are newer than a reference file, have been changed within so many days, are owned by particular users or are greater (or smaller) than a certain size. You can’t place a lot of value in NOT finding files that you are looking for if you are basing your search on time stamps because these can be easily changed with the touch command.

[13 Things that a Unix sysadmin will never do and How to freeze Unix accounts]

The find command can locate files based on numerous criteria — type, size, age, permissions, ownership, group, etc. It’s a good idea, for example, to look for files that might have the setuid bit set — a real no-no by today’s security standards. Finding files with setuid:

$ find . -type f -perm -4000 -ls
15089715    4 -rws------   1 root     staff        11 Sep 23  2009 ./bin/oops

Finding files newer than a reference file:

$ find /usr -newer /root/ref -ls

You can also use the find command to change the files in some way — whether you want to strip execute permission, remove the files entirely, change ownership … In the command below, we look for and remove the setuid bit.

$ find . -type f -perm -4000 -exec chmod u-s {} ;

You might like this version better because it also shows you the files prior to the fix.

$ find . -type f -perm -4000 -ls -exec chmod u-s {} ;
15089715    4 -rws------   1 root     staff        11 Sep 23  2009 ./bin/oops

file

The file command displays the basic type of a file such as text, jpg, binary, symbolic link, block special, etc. It examines the content of files to make this determination, so it won’t be fooled by file names. If you have an executable with an extension of .txt or .jpg, file looks at the file and tells you what it really is. What is this mysterious beerlist file? Is it worth investigating now or during Happy Hour?

$ file beerlist
beerlist: UTF-8 Unicode English text

Hmm, a new jpg file? Really?

$ file bash.jpg
bash.jpg: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/
Linux 2.6.9, dynamically linked (uses shared libs), stripped
...

Let’s look at some more files using the file command:

$ file /bin/bash
/bin/bash: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/
Linux 2.6.9, dynamically linked (uses shared libs), stripped
$ file /dev/cciss/c0d0p1
/dev/cciss/c0d0p1: block special (104/1)
$ file /proc/cpuinfo
/proc/cpuinfo: empty

strings

The strings command displays printable character sequences from binary files. Its output isn’t restricted to the content of print statements, but includes library names, system calls (kernel functions), etc. The examples below should give you a feel for what this output looks like. Some will mean nothing to you. Some will tell you a lot about what you’re looking at.

$ strings /bin/bash | head -7
/lib/ld-linux.so.2
AH!D
@BH@D
B80(
E@{B
!        @
Cl $

Looking just at shared object (library) files:

$ strings /bin/bash | grep ".so"
/lib/ld-linux.so.2
libtermcap.so.2
libdl.so.2
libc.so.6
/lib/ld-linux.so.2

Looking at system called and other strings that start with “f”:

$ strings /bin/bash | grep ^f
fbLE
fflush
fork
fgets
fputc
fputs
fclose
fileno
fwrite
fdopen
freeaddrinfo
fcntl
fopen64
ferror
free_buffered_stream
find_function
find_variable_internal
find_variable
find_shell_builtin
file_status
find_reserved_word

od

The od (octal dump) command — which doesn’t limit you to octal, by the way — can be used to display the contents of a file in a number of formats. The hex/character or octal/character formats can be useful. An example is shown below.

$ od -xc /bin/bash | more
0000000 457f 464c 0101 0001 0000 0000 0000 0000
        177   E   L   F 001 001 001