file ownership changes for no reason

[viktorf]

For no reason several files on my plesk based server have different owners. Some files in a directory of domainname-one.com are now owned by the ftp-user of domainname-two.com (both in group psacln).

I've tried to find out what happened, but I have no clue. A few weeks ago this has happened to me on another Plesk based server (other location, no direct links). I couldnt find anything then either. Allthough at first i thought I had hacker breakin in, i'm now suspecting Plesk is messing things up.

Does anyone have a suggestion? I would be much obliged cause this seriously bothers me.
Thanks in advance,
Viktor

 

[trialotto]

Your first idea, the hacker maybe more realistic than plesk messing up.

In fact, it is more likely that a trojan or rootkit is present. Do a manual rootkithunter check from the command line and analyze the full rkhunter.log. Do not use the plesk interface for rootkit hunting, since this does not give you all data from the rootkit analysis.

Also be aware that plesk is a bundle of programs, with a nice interface. Any break downs in those underlying programs, changes in configuration, restarts of those underlying programs......all of those can cause the ownership issue reported by you.

However, it is very unlikely that plesk does one of the above.....rootkits and trojans do.

As a question to you, do you have the plesk panel hosted on a vps or dedicated server? Be aware that your service provider can also be the cause of your problem.