1

I am learning about file integrity and wanted to protect some files, I have already noted shadow, passwd and passwd_backup but I was wondering if there are many more and also why these need to be monitored?

closed as too broad by Jeff Schaller, techraf, G-Man, HalosGhost, grochmal Oct 10 '16 at 17:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'd say that integrity is important for every single file. – dr01 Oct 11 '16 at 7:22
2

This is a difficult question because it will depend a lot of what you are doing on the server.

First of all, is it your desktop or a server? If it's your personal computer, you are ok with what you already have.

If you are on a server, you can monitor all your config files to check if anything change on the server. For instance, if you are running PostgreSQL, it can be a good idea to monitor the pg_hba.conf.

You can also manage your server with tools like puppet or chef or ansible. With those tools you can easily force the content of a file. If you modify it, puppet will just reset it to default value. If you want to modify it, you have to do it via your config management tool.

The best way to figure out what is useful for you is to install your server and to check which files you modify during the configuration of the server. Then you can monitor those files to ensure no one is modifying your server.

Good luck

  • I need to know which files need to be monitored so that if say the hash values are changed this could mean an attacker is attempted to break into the system etc – justinmartin123 Oct 11 '16 at 11:54
  • Didi you try SELinux? It had some complexity but I think it can help you achieve your goal. Be careful, checking the integrity of your whole system in real time is quite hard. You have to know that if someone try to break into your system, there are good chance he won't modify anything on your system. He may add some file, find a way to execute code remotely or another mean but you can't monitor it via file integrity. – charles-edouard gagnaire Oct 12 '16 at 7:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.