Can one change the contents inside auth.log? I have read that a hacker can change it so that there won't be any trace but I have not found a definite answer or anything that will explain or show signs of tampering.


/var/log/auth.log is owned by syslog:adm, with permission 0640, so:

  • only user syslog can write to the file
  • user syslog and any member of group adm can read the contents of the file
  • no one else can read or write to the file
  • no execute permission for anyone as its supposed to be plaintext log file

So, as you can see only way to change i.e. write to the file is to:

  • run the process as user syslog
  • or be root who can do anything anywhere in the system

For an outsider/cracker to break in and change the logfile, they need sufficient privileges like mentioned above.

For example, they could use a privilege escation vulnerability, a zero day attack (depends on target value mostly), or a plain password brute forcing, or something else altogether to get in as privileged user.

If they can get in, you have more important things to worry about than changing the contents of any log file. In essence, that won't be your computer any more.


Every file has a particular set of access permissions associated with it.
The file /var/log/auth.log file can be modified only by having root privileges and not by a general user. So, for the hacker or an attacker who wishes to modify the contents of this file in order to wipe out the traces of his act he needs to have root privileges.

He will hence try to use some privilege escalation attacks by exploiting the known and un-patched vulnerability or with some new unknown zero day vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.