2

This question already has an answer here:

Is there any commonly used shell script or utility to periodically check Linux file systems for changes, such as permission or ownership changes of configuration files.

I am thinking of something similar to OpenBSD's security(8), that could be run weekly or daily via a cronjob and make a simple report of changes, but tailored for Linux or portable across different Unix-like systems.

I am mostly interested in Linux Red Hat, but any starting point from a portable utility or any similar OS would be great.

I looked at fam and gamin but it seems these are APIs meant for use by application developers, not system administrators who just wish to periodically monitor changes in certain files and directories.

marked as duplicate by Gilles linux May 16 '16 at 23:22

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Keep in mind that these tools can only detect misconfigurations, they can't detect intrusions, because (most) malware takes care to hide the changes that it makes. – Gilles May 16 '16 at 23:23
1
  • Use the audit package to accomplish this task.

  • Ensure the auditd service is running, and set to start on boot chkconfig auditd on

  • Set a watch on the required file to be monitored by using the auditctl command : For e.g

auditctl -w /etc/hosts -p war -k monitor-hosts

That is:

  1. auditctl : the command used to add entries to the audit database.
  2. -w : Insert a watch for the file system object at path, i.e. /etc/hosts.
  3. -p : Set permissions filter for a file system watch. r=read, w=write, x=execute, a=attribute change.
  4. -k : Set a filter key on an audit rule. The filter key is an arbitrary string of text that can be up to 31 bytes long. It can uniquely identify the audit records produced by a rule.

Note that you must add your rule to /etc/audit/audit.rules on RHEL5 or RHEL6 (or /etc/audit.rules on RHEL4) in order for them to persist after reboot.

There is another answer by Stéphane Chazelas, you can have look at that too which might help.

Not the answer you're looking for? Browse other questions tagged or ask your own question.