I recently granted one user sudo access rights on test server. This morning I see that server is screwed up. I see that owner rights where changed on many directories. For example many root directories ownership was changed to my user. I'm guessing that user used chown in a wrong place.

Is there an option to see if chown was used by specific user on specific directory?


sudo generally logs executed commands in e.g. /var/log/auth.log or /var/log/sudo.log depending on your distribution, so check there for sudo: lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.