LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   How do I audit access or modifications to a folder? (https://www.linuxquestions.org/questions/linux-security-4/how-do-i-audit-access-or-modifications-to-a-folder-349766/)

tisource 08-03-2005 09:31 PM

How do I audit access or modifications to a folder?
 
I'm not sure there is a clear solution for this, but here goes...

I have a folder located on a Reiser file system. I want to know when files or folders are added to this folder. I want to know if folders or files change in size. I want to know when folders or files are deleted from this folder.

Is there a way to do this on a system level (so it doesn't matter whether changes come)?

btmiller 08-03-2005 10:50 PM

You can you fam (file alteration monitor) but this is not totally foolproof since sgi_fam at least used to have a set of security issues on its own (has this changed? I confess I've not looked recently). Otherwise, maybe do a proper installation of tripwire or AIDE and configure it to watch that folder. Run it frequently via cron if you're paranoid. If you're really paranoid, install auditing in the kernel too and use it to complement user space monitoring.

mastahnke 08-04-2005 08:26 PM

You could also run auditd, or selinux and define rules for this certain directory and see what changes. Commercial products can do this also, such as Computer Associates eTrust Access Control.

The logs can be quite nice, including who made the change, and what type, even if they are su'd to root, there original name is still logged.


All times are GMT -5. The time now is 02:09 AM.