Chuck Swiger cswiger at mac.com
Thu Jun 16 19:41:07 GMT 2005

Jean-Paul Natola wrote:
> I have a Powervault on our network , Dell informs me that since its NOT
> windows powered I have basically no specific control , auditing etcc,,
> A network folder was deleted from the NAS yesterday, and I have no way of
> determining who did it.
> I know it's a *nix  kernel.

Run "uname -a", and figure out exactly what the system is.  While there are 
lots of ways to set up auditing of a Unix-like system, if they weren't turned 
on already, it is unlikely that you are going to figure out much about an event 
which already happened.

Anyway, you should recover the deleted folder from your backups.
If you weren't making backups, start.

> Also there are files there that , when we want to delete (MAC files often) it
> says access denied.
> Ideally , set permissions (i.e.  can read , write, change, NOT delete), also
> audit to see who did what when , and delete those "access denied" files-
> I'm sure if I can get into it through a shell? Or root?  This would be
> possible??? Maybe???

It's likely that if someone starting maintaining this system and sets up user 
permissions correctly, the situation would improve considerably.


More information about the freebsd-questions mailing list