I am learning about file integrity and wanted to protect some files, I have already noted shadow, passwd and passwd_backup but I was wondering if there are many more and also why these need to be monitored?
closed as too broad by Jeff Schaller♦, techraf, G-Man, HalosGhost, grochmal Oct 10 '16 at 17:42
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
This is a difficult question because it will depend a lot of what you are doing on the server.
First of all, is it your desktop or a server? If it's your personal computer, you are ok with what you already have.
If you are on a server, you can monitor all your config files to check if anything change on the server. For instance, if you are running PostgreSQL, it can be a good idea to monitor the pg_hba.conf.
You can also manage your server with tools like puppet or chef or ansible. With those tools you can easily force the content of a file. If you modify it, puppet will just reset it to default value. If you want to modify it, you have to do it via your config management tool.
The best way to figure out what is useful for you is to install your server and to check which files you modify during the configuration of the server. Then you can monitor those files to ensure no one is modifying your server.