0

Recently I have an attack to one of my servers. Apart from harden the security measures at place, I am planning to install a tool to monitor changes in the filesystem.

I want a free tool (no cost) and want it to send reports via email or save the results remotely to avoid manipulation.

I've been check fam and I think it could do the job. However I wanted to know if there are other solutions out there.

  • 2
    What Distribution are you using? I know some have the ability to install an audit package that is part of the base OS, just not installed by default. – thebtm Jan 11 '18 at 21:42
4

If you are using a CentOS / RHEL based system, you can install audit.x86_64 and configure the default auditing system for the server for commands, files, what ever you are looking to audit. There is a how to for Cent OS below and I also linked the RHEL site but it may require an account. I am not familiar with Debian based systems or Ubuntu so it could be the same commands with a similar package. A quick google search also finds something for Ubuntu pretty quick.

RHEL/CentOS:
CentOS 7 How To Use the Linux Auditing System
RHEL 7 System Auditing
RHEL 6 System Auditing

After looking into it a bit more, the same auditctl system seems to be able to be installed on Ubunutu as RHEL 7.

Ubuntu:
the command below will install it on Ubuntu. the man pages should explain how it works though I am fairly sure its almost the same as the RPM installed version.
sudo apt-get install auditd

  • My distribution is Ubuntu 16 server – Raul Luna Jan 12 '18 at 9:39
1

tripwire is getting a bit long in the tooth, but still works well and does the job it supposed to (send you emails warning of any and all changes to monitored files - e.g. set it to monitor all files by default and exclude files/dirs you don't care about).

Available pre-packaged for most, if not all linux distros (as well as *bsd). Here's the description from the debian tripwire package:

Package: tripwire
Description-en: file and directory integrity checker
 Tripwire is a tool that aids system administrators and users in
 monitoring a designated set of files for any changes.  Used with
 system files on a regular (e.g., daily) basis, Tripwire can notify
 system administrators of corrupted or tampered files, so damage
 control measures can be taken in a timely manner.

Homepage: https://github.com/Tripwire/tripwire-open-source

I also recommend using git for version control of all important files (and git push to push changes to a remote repository as a backup to protect against corruption and accidental or deliberate deletion).

And, of course, etckeeper for automating revision control (git by default) on /etc:

Package: etckeeper
Description-en: store /etc in git, mercurial, bzr or darcs
 The etckeeper program is a tool to let /etc be stored in a git, mercurial,
 bzr or darcs repository. It hooks into APT to automatically commit changes
 made to /etc during package upgrades. It tracks file metadata that version
 control systems do not normally support, but that is important for /etc, such
 as the permissions of /etc/shadow. It's quite modular and configurable, while
 also being simple to use if you understand the basics of working with version
 control.

Homepage: https://etckeeper.branchable.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.