On Thu, 19 Jul 2012 08:55:29 +0200, Erik Nørgaard wrote: > Now, I have no idea which processes actually require access to those > files, what privileges these processes run with and which files are > actually executable or just plain files.
For differentiating "files' nature", use "file <file(s)>" to identify if it's an executable, a script (which _may_ or _may not_ need +x attributes), or just some random text or binary file. Regarding access to files: You could first determine which programs are installed on that server and create a "testing bed" for them, e. g. using jails on a separate system. Then you can use tools like "lsof" to see what files are accessed, and in which matter (read, read/write). At this occassion, you can also examine what files have been installed to the system by this program's installer process, and what attributes they do _properly_ have. You can find information about _what_ is installed _where_ and _how_ in the package lists of each port. You can use them to compare currently installed stuff with how it should be. Regarding the OS, there's another helpful mechanism to investigate: Check out the files /etc/mtree which can be used to automatically compare the definitions with their current (probably malformed) real counterparts. Also see "man mtree" for details. > At this moment my project is to migrate servers with these permissions > to new servers, but those who prepared the OS have maintained the > permissions from the older version because it's easier than actually > investigating or understanding what's going on and find a solution. *sigh* I think the most safe method would be if you install a new server from scratch, install the PROGRAMS as needed, and then first copy the DATA with _default_ permissions and check if everything works. If you see that the new system works properly, you can easily switch over from the old system. If you have successfully done it, take the box to the "admin" who was "responsible" for it and drop it onto his head, so he can recover from "professionality". :-) > So, how can I > > - determine if files are actually unix executables or just plain files > (or windows executables)? As I said, file, mtree, pkg-plist. > - determine which users actually need read or write access to these files? Talk to the users (or better to their superiors, or anyone who is partially able to talk about what they're doing). User access should be separated and kept inside /home. There are very few cases where this method is not sufficient. Maybe you can find such a case and prepare a _proper_ solution to deal with it. If it's about what _programs_ need to access, check their documentation and configuration files. > the second is what I think is the most difficult, I need some lsof > daemon to log access... I think it's quite hard to determine requirements "in vivo". The more restricted your testing bed is, the more precise are your findings and therefor your answers. Have as few variables as possible. On a server actually running, using a malformed configuration and many altered settings (where you can't even properly tell _what_ has been altered!), testing will be quite hard. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
