LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 08-03-2005, 10:31 PM   #1
tisource
Member
 
Registered: Feb 2002
Posts: 322

Rep: Reputation: 30
How do I audit access or modifications to a folder?


I'm not sure there is a clear solution for this, but here goes...

I have a folder located on a Reiser file system. I want to know when files or folders are added to this folder. I want to know if folders or files change in size. I want to know when folders or files are deleted from this folder.

Is there a way to do this on a system level (so it doesn't matter whether changes come)?
 
Old 08-03-2005, 11:50 PM   #2
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,160

Rep: Reputation: 329Reputation: 329Reputation: 329Reputation: 329
You can you fam (file alteration monitor) but this is not totally foolproof since sgi_fam at least used to have a set of security issues on its own (has this changed? I confess I've not looked recently). Otherwise, maybe do a proper installation of tripwire or AIDE and configure it to watch that folder. Run it frequently via cron if you're paranoid. If you're really paranoid, install auditing in the kernel too and use it to complement user space monitoring.
 
Old 08-04-2005, 09:26 PM   #3
mastahnke
Member
 
Registered: Feb 2002
Location: IL
Distribution: Ubuntu currently, also Fedora, RHEL, CentOS
Posts: 111

Rep: Reputation: 15
You could also run auditd, or selinux and define rules for this certain directory and see what changes. Commercial products can do this also, such as Computer Associates eTrust Access Control.

The logs can be quite nice, including who made the change, and what type, even if they are su'd to root, there original name is still logged.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
modifications in a squashfs filesystem fenix4life Linux - General 2 11-10-2009 04:26 AM
Folder Max Size and Limiting SSH access to home folder. Mefistofeles Linux - General 4 11-26-2005 03:09 PM
Chmod rights and folder access fieldyweb Linux - General 3 08-24-2005 05:12 AM
Unwanted modifications to fstab erika_Dec2004 Mandriva 1 04-10-2005 01:29 PM
Can't access Applications folder cordedpoodle Linux - Newbie 3 10-04-2003 12:51 PM


All times are GMT -5. The time now is 05:56 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration