Someone was asking me some questions about symlink topics privately and part of that discussion, I told them about how to determine if a file has a symlink pointing to it, "hard" or "soft" and that little piece of information might be useful to some of you if you don't already know about this.
Code:
# ls -l -- pass* shad*
-rw-r--r-- 1 root root 6562 Jul 6 21:14 passwd
-rw-r--r-- 1 root root 6562 Jul 15 02:08 passwd-
-rw------- 1 root root 22346 Jul 15 02:08 passwd.cache
-rw------- 1 root root 17586 Jul 15 02:08 passwd.nouids.cache
-rw------- 1 root root 5553 Jul 15 02:08 shadow
-rw------- 1 root root 5553 Jul 15 02:08 shadow-
In the directory listing I was returned in the above command, take notice of the "1" in the second field just after the permissions are given. This "1" is the number of symlinks that are pointing to a file including the file itself.
Folders get incremented for every file that is in the folder so they show the total number of files plus 1 typically.
Files should under normal circumstances always be "1" especially those files in user account areas.
If your /etc/passwd or /etc/shadow suddenly goes to "2" or higher, you got a problem as someone just linked to your password and user account information but that also should give you an idea about how you can easily script to monitor for these changes and alert administrators.
If you find a file has symlinks to it per the directory listing, you can pull the extended long form directory information and the inode information for the file to determine where the symlink is located. Files using hard symlinks will have the same inode identification number on the drive. This however gets quite advanced and would be a lengthy discussion topic for this forum thread.
If you want to find soft symlinks in user accounts, this is really as simple as using the 'find' command.
Code:
# find /home/*/public_html -type l
For those that have not setup their servers yet or are willing to make a major overhaul, I would strongly recommend that you put your /home on it's own partition at the least or preferably on it's own physical separate hard drive by itself and apart from / and the rest of your operating system files and folders.
The reason for this is hard symlinks can only be created within the same storage volume so by putting /home on it's own drive or partition, you disable the ability for anyone to hard link to anything outside /home leaving only soft symlinks as a possibility which are trivial to detect and eliminate.
