6

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these users to visit any of these home directories besides their own, is there any way for a user to know who visited his home folder? Such external access from the other users may not result in any change to the local files, for example, viewing or copying a file. Is there any log file or tool that can actually monitor these activities?

  • 1
    No, there is not – Ulrich Dangel Jan 23 '13 at 9:10
  • 3
    For the benefit of googling, this is called file or directory access auditing. A quick Google search (linux file access auditing) seems to indicate that there exists some possibility to do this on Linux, but I haven't looked very closely at it. – a CVn Jan 23 '13 at 9:45
6

Use Linux auditing subsystem - see man auditd or for example this introduction.

  • I want thank peterph and Michael kjoerling for bring me "audit". I see this is a powerful tool. I should have been more precise in my description of the problem. Actually, what I really what to know is that in such an 'open access' cluster system, who has copied my files. Such a operation leaves my file unchanged, and I guess 'audit' does not really help in this case. Do you know anything that can monitor such operations, e.g. copy. Thank you! – Katuru Jan 23 '13 at 18:03
  • 2
    @Katuru It can potentially help - depends on how the files are accessed (not necessarily changed). It can give you IDs under which the proceses accessing the files were running. However, if the files are copied through a service which has its own accounting (i.e. a http daemon), it is not possible to tell whom the files were offered - for that one has to check the log of the application itself. – peterph Jan 23 '13 at 18:22
  • @Katuru It is better to edit your question to clarify it, than add such (rather important) details in a comment to an answer. Editing questions to add information is commonly done on Stack Exchange, so there is no shame whatsoever in doing it. Click the "edit" link under your question and change it to clarify what you are trying to do, then click "save edits" when you are done. Just be careful to not make such edits that they completely change the purpose of the question; adding details is fine, asking new, unrelated questions in an old question is generally a bad idea. – a CVn Jan 24 '13 at 9:08
1

If you don't want your files copied, disable group/other read/execute access to your $HOME: chmod go-rwx $HOME. If you have some files you'd want to keep private, place them into a directory without group/other access. Being able to tell somebody broke in and stole stuff after the fact is rather less useful...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.