We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.
You can log on only if you have a certificate (for root user) or via ftp (a restricted partition of data for upload contents, but this is not the point) or through apache that have some permission for write onto certains directory.
In recent past we had some trouble with that policy since who can "hack" apache, could delete files onto apache's writable directories. But we didn't get scared since today.
Today we notice that a log file and a log directory, particularly the httpd log's directory and log's files, have undergone a change of permissions (in detail, someone removed the +x perm. to other users. Permissions were 755). Since the owner is root and the group is root, could someone tell me if there is an alternative explaination to "someone stole your certificate" ?
Moreover I know that keep software up to date is the best method for prevent well-known flaws, but in that case I can't image someone that via Apache could do something like that.