I'm looking for a monitoring service which look for suspicious writing on disk.

Let's say that I have a PHP/Ruby/Python website running on my server, and there is a vulnerability on my website. An attacker can upload/modify any file owned by the apache/nginx user.

Is there any service that can say : "Hey a modification has been made on index.php. It's weird because this file was never modified since its creation."

Or "Hey, there is a new file at /img/reverse.php what is a .php file is doing on /img".

  • You can do this with auditd, inotify, and so on -- but Linux doesn't know your invariants for what's "weird". You need to specify that. – Chris Down Oct 7 '17 at 22:51
  • There is no algorithm which would identify suspicious activity, and it would require a lot of effort to write heuristics / machine learning model for that. The problem you mention are solved through more precise access control. – myaut Oct 7 '17 at 23:02

Set up a regular backup scheme to another machine over the network via ssh using rsync to replicate the file tree(s) of interest. Run it with a listing of changes. Keep that listing in a dated filename on the target machine. The first time would list all the files. Scan the listings after that for what has changed. Then you can review these listings regularly or write an AI program to automate it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.