I've had some security issues lately and as I can't be totally sure that my code is secure, I have been thinking about scanning some folders and get notified when a file is changed or a new file appears.

Is there a tool that can do that?

  • find can usually do that. That finds files modified in the last hour. You can use -mminfor minute-level precision. – Bratchley Jul 12 '16 at 16:36
  • from the examples section of watch command: watch -d ’ls -l | fgrep joe’ and you can send the output to a time stamped file for future comparison – MelBurslan Jul 12 '16 at 16:38
  • 2
    Some of the answers in What are some common tools for intrusion detection? might be relevant to you. – Ulrich Schwarz Jul 12 '16 at 16:41
  • BTW shouldn't your code be in a git repo or something like that? The only thing we can really suggest would be something based on mtime which can be modified. The only real way to know for sure would be to compare files one by one looking for differences from a presumed good backup. Other than that you might try just restoring from a point in time before the breach and re-committing all your changes (git has integrity checks, but if you were compromised you can't trust those). The latter may be a lot of work but it might be worth it to avoid the possibility of tampering. – Bratchley Jul 12 '16 at 16:46
  • OSSEC is an open source option. Perhaps overkill – Neil McGuigan Jul 12 '16 at 18:12

You have the linux audit system for that, I don't know if it's installed by default on debian but you ca install it by:

$ sudo apt-get install auditd audispd-plugins

From there you need to configure it, the configuration file is /etc/audit/audit.rules, a rule for your purpose would be like:

# Delete all previous rules

# Set buffer size
-b 8192

# Make the configuration immutable -- reboot is required to change audit rules
-e 2

# Panic when a failure occurs
-f 2

# Generate at most 100 audit messages per second
-r 100

# -w: Watch a file or directory
# -p: Parameters to watch in this case are [w]rite and [a]ttributes,
#     you can also add [r]ead and e[x]ecute but I think those
#     are not needed in your case
# -k: An optional friendly name to facilitate searching the logs
-w /path/to/your/repo -p wa -k name_for_easy_searching

The audit setup is ready, restart the auditd daemon for it to load your new rules and confirm they're actually loaded with auditctl -l.

Now your repo is being monitored at kernel level, so any changes will be recorded.

Use ausearch -k name_for_easy_searching to get a list of all the changes done to your repo.

From there is upt to you how to parse the log, ignore changes made by your user, send an email, set up a cron job to check periodically...

Good Luck.


another option is AIDE (advanced intrusion detection environment). It is free and you can get started pretty easy with one of the sample config files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.