We have a RHEL6 server that was built using an old homegrown build platform. The team that built the platform was disbanded, and all members have moved on. So, we are trying to figure out everything that they did to implement the old "company security standard".

Whenever the host reboots, multiple files seem to be getting overwritten (/etc/resolv.conf, /etc/nsswitch.conf, etc). We have searched the system for instances of the strings within those files, and we can't find them. So far as I can tell, the host is not running a puppet agent (the old platform was built on puppet). The hosts would invoke puppet one time at build to pull down configs from a puppet master, but that is it. There is no puppet auditing in place.

NetworkManager isn't installed, and the host is running static network configuration, so it shouldn't be pulling the information from DHCP.

I see no conspicuous processes that run during startup in /etc/init.d, and I've also checked every runlevel. Looking at boot logs I don't see anything else that seems like it could be causing the problem.

As a band-aid, I have made the files immutable, and for now that works. But it still doesn't help me if there are some other files that are being changed that we haven't noticed yet. Ideally, we would rebuild the host using the new build system we have implemented, but that is not currently an option (being used as part of some ongoing research).

Is there any way to track processes that attempt to access a file? Or attempt to modify a file? If I could do that, I could easily track down what process is being run that modifies the settings, and also hopefully track down every file that is getting modified.

  • I'd looking at version controlling the config files with something like git. At least then, you can track all changes that have taken place. – Raman Sailopal Jan 24 '18 at 14:24
  • We actually have a template for the files. The problem is that whenever the host reboots, the files are magically reverted to some other version. There's not really a need to version control them (though on our new build platform, we use jinja2 templates in git for them). – Matthew Jan 24 '18 at 14:30
  • auditd, or perhaps a SystemTap module that reports activity on a given file. trick will be getting them running early enough (other things to check for would be @reboot cron jobs or in /etc/rc.d/rc.local) – thrig Jan 24 '18 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.