Mastering Linux Security and Hardening - Second Edition

Auditing a file for changes

Now, let's say that we want to see when someone changes the /etc/passwd file. (The command that we'll use will look a bit daunting, but I promise that it will make sense once we break it down.) Here goes:

[donnie@localhost ~]$ sudo auditctl -w /etc/passwd -p wa -k passwd_changes[sudo] password for donnie:[donnie@localhost ~]$ sudo auditctl -l-w /etc/passwd -p wa -k passwd_changes[donnie@localhost ~]$

Here's the breakdown:

• -w: This stands for where, and it points to the object that we want to monitor. In this case, it's /etc/passwd.
• -p: This indicates the object's permissions that we want to monitor. In this case, we're monitoring to see when anyone either tries to (w)rite to the file or tries to make (a)ttribute ...