Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite
1

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these users to visit any of these home directories besides their own, is there any way for a user to know who visited his home folder? Such external access from the other users may not result in any change to the local files, for example, viewing or copying a file. Is there any log file or tool that can actually monitor these activities?

share|improve this question
1  
No, there is not – Ulrich Dangel Jan 23 at 9:10
3  
For the benefit of googling, this is called file or directory access auditing. A quick Google search (linux file access auditing) seems to indicate that there exists some possibility to do this on Linux, but I haven't looked very closely at it. – Michael Kjörling Jan 23 at 9:45

2 Answers

up vote 6 down vote

Use Linux auditing subsystem - see man auditd or for example this introduction.

share|improve this answer
I want thank peterph and Michael kjoerling for bring me "audit". I see this is a powerful tool. I should have been more precise in my description of the problem. Actually, what I really what to know is that in such an 'open access' cluster system, who has copied my files. Such a operation leaves my file unchanged, and I guess 'audit' does not really help in this case. Do you know anything that can monitor such operations, e.g. copy. Thank you! – Katuru Jan 23 at 18:03
2  
@Katuru It can potentially help - depends on how the files are accessed (not necessarily changed). It can give you IDs under which the proceses accessing the files were running. However, if the files are copied through a service which has its own accounting (i.e. a http daemon), it is not possible to tell whom the files were offered - for that one has to check the log of the application itself. – peterph Jan 23 at 18:22
@Katuru It is better to edit your question to clarify it, than add such (rather important) details in a comment to an answer. Editing questions to add information is commonly done on Stack Exchange, so there is no shame whatsoever in doing it. Click the "edit" link under your question and change it to clarify what you are trying to do, then click "save edits" when you are done. Just be careful to not make such edits that they completely change the purpose of the question; adding details is fine, asking new, unrelated questions in an old question is generally a bad idea. – Michael Kjörling Jan 24 at 9:08
up vote 1 down vote

If you don't want your files copied, disable group/other read/execute access to your $HOME: chmod go-rwx $HOME. If you have some files you'd want to keep private, place them into a directory without group/other access. Being able to tell somebody broke in and stole stuff after the fact is rather less useful...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.