get IP address who modified a file

Question

I am looking a way to to get the history of a file, like the modification date, who modified this file (ip address or username), the changed lines

Is there a way to get the IP address or username of who modified a file in linux?

Answer 1

Not likely in one step, but you can see who logged into a system using w and you can match the modification times of the files shown by stat with the logged in time of the user. If the file isn't 777, you can also consider the permissions of the given user to filter this down to only people able to edit the file. Otherwise, look into auditing file system events.

Answer 2

To monitor user login history you can try Utmpdump . It will give you users,times,ipaddresses of logins

to display the contents of /var/run/utmp, run the following command:

utmpdump /var/run/utmp

To do the same with /var/log/wtmp:

utmpdump /var/log/wtmp

And with /var/log/btmp:

utmpdump /var/log/btmp

you can use the following command to list all login events of a particular user (example: USER12345 ) and send the output to a .csv file that can be viewed with a pager or a workbook application, such as LibreOffice's Calc or Microsoft Excel.

Let's display PID, username, IP address and timestamp only:

utmpdump /var/log/wtmp | grep -E "\[7].*USER12345" | awk -v OFS="," 'BEGIN {FS="] "}; {print $2,$4,$7,$8}' | sed -e 's/\[//g' -e 's/\]//g'

Answer 3

If somebody is changing files remotely without authorization, you have very serious security problems.

You should disconnect the machine from the Internet, back up only configuration and data files, go over them with a fine comb to make sure nothing is fishy, reinstall from scratch, make sure you aren't running any vulnerable programs (specially user-written ones!), change all passwords to secure ones, disallow e.g. password SSH connections. Read up on securing your distribution, how to set up detailed logging and analyze the logs regularly.

My condolences.