We have a RHEL6 server that was built using an old homegrown build platform. The team that built the platform was disbanded, and all members have moved on. So, we are trying to figure out everything that they did to implement the old "company security standard".
Whenever the host reboots, multiple files seem to be getting overwritten (/etc/resolv.conf, /etc/nsswitch.conf, etc). We have searched the system for instances of the strings within those files, and we can't find them. So far as I can tell, the host is not running a puppet agent (the old platform was built on puppet). The hosts would invoke puppet one time at build to pull down configs from a puppet master, but that is it. There is no puppet auditing in place.
NetworkManager isn't installed, and the host is running static network configuration, so it shouldn't be pulling the information from DHCP.
I see no conspicuous processes that run during startup in /etc/init.d, and I've also checked every runlevel. Looking at boot logs I don't see anything else that seems like it could be causing the problem.
As a band-aid, I have made the files immutable, and for now that works. But it still doesn't help me if there are some other files that are being changed that we haven't noticed yet. Ideally, we would rebuild the host using the new build system we have implemented, but that is not currently an option (being used as part of some ongoing research).
Is there any way to track processes that attempt to access a file? Or attempt to modify a file? If I could do that, I could easily track down what process is being run that modifies the settings, and also hopefully track down every file that is getting modified.