Hello friends ,

Any one have an idea for

How to : Identify changes made with root ?

For all Unix OS platform .


Thanks

AVKlinux

During operations, after it happened, what? Please elaborate.

If you don't suspect malicious activity then you can look at the /root/.bash_history if you're using bash (if its malicious it won't show what you're looking for in all likelihood.) You could also identify all files on the drive that have been changed in a given time frame using find. If you suspect malicious activity and aren't a security expert I would suggest using rkhunter/chkrootkit at the least and verifying the integrity of ps and ls using your package manager (eg: rpm -v).

If you wish to provide additional information on exactly what you mean, I'm sure we can provide more information.

Sorry for insufficient information .

But i just want to know how can we check the changes after login as a root .

Its applicable for changes in file permissions , security setting etc...

Thanks
AVKlinux

And yet you still don't provide any information. See the post from unSpawn....

WHAT CHANGES? WHAT ARE YOU LOOKING FOR???

You're question is very vague. If you want to know EVERYTHING that changed, you'll have to install something like Tripwire, and have it check on a routine basis. Otherwise, like rweaver told you, check the .bash_history, and follow the other suggestions that were made to you.