From owner-freebsd-questions@FreeBSD.ORG Wed Apr 6 14:55:05 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 503D216A4CE for ; Wed, 6 Apr 2005 14:55:05 +0000 (GMT) Received: from hedwig.mgh.harvard.edu (hedwig.mgh.harvard.edu [132.183.156.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id C6ACA43D1F for ; Wed, 6 Apr 2005 14:55:04 +0000 (GMT) (envelope-from remorse@partners.org) Received: from [132.183.156.105] (buxtehude.mgh.harvard.edu [132.183.156.105]) by hedwig.mgh.harvard.edu (8.13.1/8.13.1) with ESMTP id j36EtHYW000628 for ; Wed, 6 Apr 2005 10:55:20 -0400 (EDT) (envelope-from remorse@partners.org) Mime-Version: 1.0 (Apple Message framework v619) Content-Transfer-Encoding: 7bit Message-Id: Content-Type: text/plain; charset=US-ASCII; format=flowed To: questions@freebsd.org From: Richard Morse Date: Wed, 6 Apr 2005 10:55:04 -0400 X-Mailer: Apple Mail (2.619) Subject: Owner permissions suddenly set to -x, possible compromise? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Apr 2005 14:55:05 -0000 Hi! I came in the morning and discovered that the file permissions on every cgi I have on my webserver had been set to u-x,go+x. This seems to have changed at about 4:30a this morning. I'm a bit worried by this, as I can't think of anything that would cause this, and there's nothing in any of the log files that would explain it. Has anyone run into this before? Can you direct me to a place I might find more information on it? A quick google search on "owner cannot exec" didn't turn up anything... Thanks, Ricky