Before you begin

For each filesystem you wish to check, you need to know the mount point, filesystem type, and device name. These can be obtained from the /etc/vfstab file. Ensure the filesystems are mounted.

To obtain a list of all of the set-UID files on a filesystem, perform the following:

1. Change your working directory to the mount point for the filesystem using the cd command. Enter
   
   cd pathname

2. Execute the following command:
   
   ncheck -s device_name | cut -f2 | xargs ls -l >filename

   The filename is the name of a temporary file.

3. Check filename for suspicious files. You can compare it with a reference file if you have one available.

4. Remove filename when you are finished.