Audit a user's file creations (or edits)

[michael1212]

Is there a way to log an event whenever a specific user creates (or edits/saves) any file? The Audit system does not seem to help in this regard. What is the easiest/best way to do this? The event logged should contain the time, filename, and command used.

Thanks!

 

[mrn]

Take a look at tripwire it may meet your needs.

A deployment tutorial can be found at

http://www-128.ibm.com/developerworks/eserver/tutorials/tripwire.html

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[RodKnowlton]

To capture the user, time, filename and command every time a file is created or altered you'd need to have hooks into a lot of system calls. Even if possible, say through a kernel extension, there's a pretty good chance it would kill your system's performance.

If you can settle for just the filename and a time period, use tripwire as mrn suggested.

Rod Knowlton
Sometime Author
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+ / CompTIA Security+

 

[mrn]

Or you could use "script" if you've loads of spare disk space.

See

man script

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[KenCunningham]

But be aware that script can be fairly easily circumvented by savvy users.

 

[RodKnowlton]

There's an article in the latest issue of Sys Admin (and online) titled Archiving Korn Shell History Files.

<shameless_self_promotion>
Ed Schaefer and John Spurgeon, the authors of the aforementioned article, have written a lot of good stuff, even if I did find a security hole in one of their articles and plug it myself.
</shameless_self_promotion>


Combine the article's techniques with tripwire, and you'll have most of what you want, except for protection from Ken's savvy users.

The best cure for a savvy user might be to recruit them to IT.

Rod Knowlton

IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+