The Ownership Audit
When multiple users share an Ubuntu Linux server, the filesystem can quickly become chaotic. If a specific user resigns from the company, or if you suspect a compromised user account has been secretly planting malicious scripts across various directories, you cannot search through the server manually. You must instantly isolate every single file and folder owned by that specific individual, regardless of where they hid it, so you can transfer ownership or delete the data.
Using the find Command with -user
The Linux find command utilizes the -user flag to filter the entire filesystem strictly by the assigned owner.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- To search the entire
/var/www/directory for every single file owned by the user “john”, type the following command exactly: sudo find /var/www/ -type f -user john- Press Enter and provide your administrator password.
Searching by Group
If you want to cast a wider net, you can search for files owned by an entire group rather than an individual. By swapping the flag to -group, you can find all files accessible to a specific team. For example: sudo find /var/www/ -type f -group developers. This will instantly output a list of all files that the “developers” group currently controls, allowing you to quickly audit team permissions.