who -T !!! NOTE: It shows who(individual id) is using what group id in which terminal

JATA01 · 10-09-2008, 11:29 PM

Any ideas! in case we can find, who changed a file on Linux.

Case: ~if there is a shared userid for ex: “giga” and you all know its passwd, then how can I check who actually changed the file (when he used this userid for changing that file).

Thanks-

estabroo · 10-10-2008, 08:11 AM

If it's a terminal login you probably can't (unless you have some visual surveillance on the keyboard). If it was a remote login you can check the time of the file change against the logins (look at the output of last) and see where that login came from, this will give you a group of people since you'd need to check up on anyone who was logged into that id during the time frame the change occurred.

archtoad6 · 10-14-2008, 09:42 AM

Quote:

Originally Posted by JATA01

... Case: ~if there is a shared userid for ex: “giga” and you all know its passwd, then how can I check who actually changed the file (when he used this userid for changing that file).
...

This shared userid may be your fundamental security problem. Is it feasible for you to give each user his/her own log-in, “gigann”, for instance, & assign them all to a group named “giga”. You would maintain access control through group rather than user permissions, & have a better chance to get the accountability you want.