[CentOS] Another Fedora decision

[Always Learning]

On Thu, 2015-02-05 at 16:39 -0600, Valeri Galtsev wrote:

> >>>
> >>>       -rw-r--r-- 1 root root 1220 Jan 31 03:04 shadow

> Be it me, I would consider box compromised. All done on/from that box
> since probable day it happened compromised as well. If there is no way to
> establish the day, then since that system originally build. With full
> blown sweeping up the consequences. Finding really-really-really
> convincing proof it is not a result of compromise (and yes, fight one's
> wishful thinking!).

Logically ?

1. to change the permissions on shadow from -rw-x------ or from
---------- to -rw-r--r-- requires root permissions ?

2. if so, then what is the advantage of changing those permissions when
the entity possessing root authority can already read shadow - that
entity requires neither group nor user permissions to read shadow.



-- 
Regards,

Paul.
England, EU.      Je suis Charlie.