Can one change the contents inside
auth.log? I have read that a hacker can change it so that there won't be any trace but I have not found a definite answer or anything that will explain or show signs of tampering.
/var/log/auth.log is owned by
syslog:adm, with permission
- only user
syslogcan write to the file
syslogand any member of group
admcan read the contents of the file
- no one else can read or write to the file
- no execute permission for anyone as its supposed to be plaintext log file
So, as you can see only way to change i.e. write to the file is to:
- run the process as user
- or be
rootwho can do anything anywhere in the system
For an outsider/cracker to break in and change the logfile, they need sufficient privileges like mentioned above.
For example, they could use a privilege escation vulnerability, a zero day attack (depends on target value mostly), or a plain password brute forcing, or something else altogether to get in as privileged user.
If they can get in, you have more important things to worry about than changing the contents of any log file. In essence, that won't be your computer any more.
Every file has a particular set of access permissions associated with it.
/var/log/auth.log file can be modified only by having
root privileges and not by a general user. So, for the hacker or an attacker who wishes to modify the contents of this file in order to wipe out the traces of his act he needs to have
He will hence try to use some privilege escalation attacks by exploiting the known and un-patched vulnerability or with some new unknown zero day vulnerability.