I've had some security issues lately and as I can't be totally sure that my code is secure, I have been thinking about scanning some folders and get notified when a file is changed or a new file appears.
Is there a tool that can do that?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You have the linux audit system for that, I don't know if it's installed by default on debian but you ca install it by:
$ sudo apt-get install auditd audispd-plugins
From there you need to configure it, the configuration file is
/etc/audit/audit.rules, a rule for your purpose would be like:
# Delete all previous rules -D # Set buffer size -b 8192 # Make the configuration immutable -- reboot is required to change audit rules -e 2 # Panic when a failure occurs -f 2 # Generate at most 100 audit messages per second -r 100 # -w: Watch a file or directory # -p: Parameters to watch in this case are [w]rite and [a]ttributes, # you can also add [r]ead and e[x]ecute but I think those # are not needed in your case # -k: An optional friendly name to facilitate searching the logs -w /path/to/your/repo -p wa -k name_for_easy_searching
The audit setup is ready, restart the auditd daemon for it to load your new rules and confirm they're actually loaded with
Now your repo is being monitored at kernel level, so any changes will be recorded.
ausearch -k name_for_easy_searching to get a list of all the changes done to your repo.
From there is upt to you how to parse the log, ignore changes made by your user, send an email, set up a cron job to check periodically...