security - How can I audit a Linux filesystem for files which have been changed or added within a specific timeframe?

itemprop="text">

We are a website design/hosting
company running several sites and someone was able to write arbitrary data to the file
system. We suspect that they still have some scripts installed and need a way to audit
anything that has been changed or added in the last 10 days. Is there a command or
script we can run to do this?

itemprop="text">

class="normal">Answer

Start Over:
Personally, I would have
trouble sleeping at night unless I just rebuilt each sever from a fresh install.

I recommend strongly you do this, hackers can
hide things, and make them look like they have changed even if they have if they are
good enough.

Why find won't
work:
For example, to change the modification
time:

kbrandt@kbrandt:
            ~/scrap/touch] ls -l foo
-rw-rw-r-- 1 kbrandt kbrandt 4 2010-04-05 12:22
            foo
[kbrandt@kbrandt: ~/scrap/touch] touch -m -t 199812130530 foo
            
[kbrandt@kbrandt: ~/scrap/touch] ls -l foo

-rw-rw-r-- 1
            kbrandt kbrandt 4 1998-12-13 05:30
            foo

ctime might be
better to search for if you go the find route, but there may be an easy way to change
that as well. If not easy, someone could go in and just edit the filesystem itself with
the device I imagine.

Just found the following
online with ctime, haven't tried it
though:

Since ctime is the last
            time the inode info was changed, you could
change the system date, make a new
            hardlink, remove it again and change
the date
            back.

And
this stuff is only using tools that are already on the system in userland, forget what
someone could do if they are proficient in kernel programming.