User monitoring on Linux

[zum]

Hi,

I have created a file server using Fedora 2 and was trying to figure out a good way to monitor the users accessing the server and the files that are being accessed. What is the best way of doing this?

Thanks

 

[ericbrunson]

There isn't a good way, anything you do can be circumvented.

The best thing to do is set up the security on the system properly and not care what your users are doing because you know they can't get into anything they shouldn't.

 

[marsd]

There are all kinds of options. tripwire or aide for file
system checks, using heightened logging levels for syslogd
against all processes and categories, and finally hardening the kernel:

http://www.securityfocus.com/infocus/1539.

 

[marsd]

Also since kernel 2.4 you may be interested to note that you can write a trivial real-time file monitoring daemon using fcntl() and syslog() given a listing of directory names
to monitor. man fcntl. Look for F_NOTIFY.