Enterprise Cloud Security and Governance

Solution

In order to achieve this use case, let's look into how auditd would help here:

1. Let's create a text file inside the /etc directory called credit.tx:

         [root@mykplabs ~]#   touch /etc/credit.txt

2. Let's put some contents within this file so that it seems interesting:

        [root@mykplabs ~]#   echo "This is a very important file" > /etc/credit.txt

3. With the help of the audit daemon, let's create our first rule that will track all attempts to this file:

        auditctl -w /etc/credit.txt -p rwa -k credit-file

In the above command we are using various options along with auditctl. Let's have a look into each of them:

• -w: Watch this particular file for tracking
• -p: These are the permissions that we need to watch for
• r: Any attempts to read the file ...