0

I’m a Mac OS X user and I’m trying to write and run a script that will alert me - or mail me via and inside terminal emulator - whenever a file is created, modified, or changed, for security purposes. I have no idea how to do it and how to start the script since everything on Mac is a bit different than on Linux, since it’s closed. I know how I should do it if I want to use it on a certain directory, but I want it for all directories except log files put under /var/log and I want it to tell me what’s been changed and where the change was. So checking the bit/bytes to determine the change is useless.

In fact, I want to beware of any change. I know I may face with thousands of changes, but I just want to be kept informed on whatever changing to be sure everything is in the normal situation. In other words, I want to monitor my system data on OS X.

Can anybody help me with this?

  • 2
    This would be very annoying. A Unix system is based on files and there would be created and deleted a lot. Especially when you do an upgrade or so. – hschou Aug 27 '16 at 19:49
  • There are a lot of ways you could go about this. You could learn about intrusion detection systems, you could set up puppet, you could write your own script. If you were to write your own script you would probably want to learn about the md5sum command and maybe use sqlite to store know good values of the file. – Red Cricket Aug 27 '16 at 19:51
  • @RedCricket Great, can you just explain a bit more on what I should do and what thing I gotta go for? – Parsa Samet Aug 27 '16 at 22:08
  • 1
    You could probably use dtrace for this. – Mark Plotnick Aug 27 '16 at 22:20
  • 1
    sounds like you really want a HIDS. Try OSSEC – Neil McGuigan Aug 28 '16 at 1:02
3

This is pretty much pointless. Lots of files are modified on a regular basis. If you exclude all the data files that get modified in normal operation, you're already missing out on some potential attack vectors, and still left with all the normal software upgrades (and upgrades are absolutely necessary, at least, for security). Furthermore an attacker who gains root access can change the system to turn off your detection mechanism, so this is only useful at all if you only monitor files that are not owned by root.

But if you want to do it anyway, use existing software, such as AIDE (available in MacPorts) or Tripwire (Google turns up several tutorials for OSX, I can't comment on them).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.