0

Is there a way to log any files copied from the server to a PC on the network? It would be a specific directory on the server (Centos 6).

I have tried searching for an answer to this but to no avail so thought I'd ask here.

Edit for clarity: I just mean via the network. So someone has navigated to \Server\MyFolder and copied the contents to their desktop using drag and drop

  • Copied how? To a networkshare, via scp, via ftp, the list goes on...? – Panki Jan 21 at 10:28
  • Ah sorry! I just mean via the network. So someone has navigated to \\Server\MyFolder and copied the contents to their desktop using drag and drop – Lee Jan 21 at 10:34
  • Are you using samba? – Panki Jan 21 at 10:43
  • Yes using Samba – Lee Jan 21 at 12:18
1

Yes you can! But each protocol has its method.

For SAMBA doc here:

  1. Add SAMBA audit module (already in your Samba, just enable it)
  2. Edit smb.conf

    valid users = ...
    vfs objects = full_audit
    full_audit:failure = none
    full_audit:success = mkdir rename unlink rmdir open pwrite
    full_audit:prefix = %u|%I|%m|%S
    

For NFS:

You need to enable the debug mode: rpcdebug -m nfsd -s all And to stop it : rpcdebug -m nfsd -c

  • Hi! Thanks for this. Yes we are using SAMBA. Where would step 2 be entered? Within the share definition? – Lee Jan 21 at 12:18
  • Yes, in the share definition ( valid users is a typical option from the share definition) – jayooin Jan 21 at 12:23
  • Note that, you don't have to add valid users = ... It is only for an example. you can add more options as well, as seen in the documentation. – jayooin Jan 21 at 12:24
  • Would this Question just need the "open" audit? – Jeff Schaller Jan 21 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.