chattr Command: Make Linux Files Immutable to Prevent Unauthorized Modification

What is chattr?

The chattr command changes extended attributes on Linux filesystem files — most importantly the immutable flag (+i). A file with the immutable attribute set cannot be modified, deleted, renamed, or have its permissions changed by any user — including root — without first removing the immutable flag. This provides a meaningful protection layer for critical configuration files: even if an attacker gains root access, they cannot modify an immutable file without an explicit additional step that will be visible in audit logs. The companion command lsattr displays current file attributes, revealing whether the immutable flag is set or — critically — whether an attacker has used chattr to protect their own persistence files from deletion.

Syntax

chattr +i filename          # Set immutable flag
chattr -i filename          # Remove immutable flag
chattr +i -R /etc/ssh/      # Recursively set immutable
lsattr filename             # Show file attributes
lsattr -R /etc/ | grep '\-i-'  # Find all immutable files in /etc

chattr +attribute adds an attribute, chattr -attribute removes it. The -R flag applies changes recursively. Key attributes: i (immutable — cannot be modified or deleted), a (append-only — can only be appended to, not overwritten), e (extents — informational, set by default on ext4 files). lsattr displays attributes as a string of flags.

Key Attributes and Flags

Common Use Cases

Set Immutable Flag on /etc/passwd to Prevent Unauthorized Modification

The /etc/passwd file contains user account information. An attacker who gains root can add a backdoor account by appending a line. Making it immutable adds a required additional step that will be logged by the audit subsystem and may not be performed by automated attack tools.

# Set immutable on critical account files
chattr +i /etc/passwd /etc/shadow /etc/gshadow /etc/group

# Verify
lsattr /etc/passwd /etc/shadow

# Before any legitimate modification (e.g., useradd), remove first
chattr -i /etc/passwd
useradd newuser
chattr +i /etc/passwd

Protect SSH Configuration and Authorized Keys

An attacker who gains root often modifies /etc/ssh/sshd_config to weaken security (re-enable root login, permit all users) or adds an entry to ~root/.ssh/authorized_keys for persistent key-based access. Making these immutable forces an explicit additional step that can be detected via audit logs.

chattr +i /etc/ssh/sshd_config
chattr +i /root/.ssh/authorized_keys 2>/dev/null
lsattr /etc/ssh/sshd_config

Detect Attacker-Set Immutable Attributes on Malware Files

Attackers frequently use chattr +i on their dropped files to prevent security tools and administrators from deleting them. Running lsattr on known attacker staging directories reveals files protected this way. The immutable flag must be removed before the file can be deleted.

# Check for immutable files in attacker staging areas
lsattr /tmp/ 2>/dev/null
lsattr /dev/shm/ 2>/dev/null
lsattr /var/tmp/ 2>/dev/null

# Remove and delete if confirmed malicious
chattr -i /tmp/suspicious_file
rm /tmp/suspicious_file

Security Relevance: Immutability as a Speed Bump, Not a Wall

Practical Examples

Harden a new server by setting immutable on core configuration files

# Apply to the most critical files
for f in /etc/passwd /etc/shadow /etc/gshadow /etc/group \
         /etc/sudoers /etc/crontab /etc/hosts \
         /etc/ssh/sshd_config /etc/fstab; do
  [ -f "$f" ] && chattr +i "$f" && echo "Protected: $f"
done

# Verify all
for f in /etc/passwd /etc/shadow /etc/sudoers /etc/ssh/sshd_config; do
  echo -n "$f: "; lsattr "$f" 2>/dev/null
done

Iterates over the most security-critical configuration files and sets the immutable flag on each. The loop skips files that do not exist (graceful for varying distributions). Verify immediately after — lsattr output should show ‘—-i———–‘ for each protected file.

Make log files append-only to prevent retroactive tampering

chattr +a /var/log/auth.log
chattr +a /var/log/syslog
chattr +a /var/log/secure
lsattr /var/log/auth.log /var/log/syslog

The append-only attribute allows the log daemon to write new entries but prevents any process — including root — from truncating or overwriting existing content. This protects the authentication audit trail from retroactive clearing while still allowing normal log rotation (which typically renames rather than overwrites).

List all files with immutable or append-only attributes system-wide

lsattr -R / 2>/dev/null | grep -E ' ----i|----a'

Scans the entire filesystem for files with immutable or append-only attributes. During incident response, this reveals two things: your own hardening controls (expected), and any files an attacker has protected with chattr to prevent deletion (unexpected, especially in /tmp, /dev/shm, or application directories).

Troubleshooting Common Issues

Summary

The chattr +i command adds the immutable attribute to files, requiring an explicit additional step before any modification — even by root. It is a low-overhead hardening measure that blocks automated attack tools, adds friction to manual attacks, and creates detectable audit events when bypassed. Apply it to the most critical configuration files during initial server setup, combine it with auditd monitoring of those files, and periodically run lsattr on staging directories to detect attacker-applied immutability on malware files.

• Apply chattr +i to /etc/passwd, /etc/sudoers, /etc/ssh/sshd_config, and cron files as a baseline hardening step
• Check /tmp, /dev/shm, and /var/tmp with lsattr during incident response — attackers use +i on malware files to prevent deletion
• Immutability is a friction layer, not a security boundary — combine with auditd monitoring for detecting bypass attempts