I am looking a way to to get the history of a file, like the modification date, who modified this file (ip address or username), the changed lines
Is there a way to get the IP address or username of who modified a file in linux?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityNot likely in one step, but you can see who logged into a system using w
and you can match the modification times of the files shown by stat with the logged in time of the user. If the file isn't 777, you can also consider the permissions of the given user to filter this down to only people able to edit the file. Otherwise, look into auditing file system events.
To monitor user login history you can try Utmpdump
. It will give you users,times,ipaddresses of logins
to display the contents of /var/run/utmp, run the following command:
utmpdump /var/run/utmp
To do the same with /var/log/wtmp:
utmpdump /var/log/wtmp
And with /var/log/btmp:
utmpdump /var/log/btmp
you can use the following command to list all login events of a particular user (example: USER12345 ) and send the output to a .csv file that can be viewed with a pager or a workbook application, such as LibreOffice's Calc or Microsoft Excel.
Let's display PID, username, IP address and timestamp only:
utmpdump /var/log/wtmp | grep -E "\[7].*USER12345" | awk -v OFS="," 'BEGIN {FS="] "}; {print $2,$4,$7,$8}' | sed -e 's/\[//g' -e 's/\]//g'
If somebody is changing files remotely without authorization, you have very serious security problems.
You should disconnect the machine from the Internet, back up only configuration and data files, go over them with a fine comb to make sure nothing is fishy, reinstall from scratch, make sure you aren't running any vulnerable programs (specially user-written ones!), change all passwords to secure ones, disallow e.g. password SSH connections. Read up on securing your distribution, how to set up detailed logging and analyze the logs regularly.
My condolences.
last
and map the users who were logged in that time. Then you can browse their.bash_history
files to see what commands they ran. Not a sure-fire way but at least a glimmer of hope.