2

Lets say I have a file, and the permissions of that file change.I want to log, report, and even require authentication for all changes to that file (even as root). as in, I do not want this file to change in anyway, without asking my permission first, and I want detail about what process, user, time, memory allocation is requesting the change. Any thing that attempts to access the file must be reported.

In windows I use strict process control to do this. How can I achieve this level of process control in linux?

3 Answers 3

4

require authentication for all changes to that file (even as root)

I have a feeling that this is not possible. Definitely not completely waterproof. The superuser is God on the system.


To monitor a file or folder, you can use the following command:

sudo apt-get install auditd    # if not already installed

sudo auditctl -w <path_to_file> -p w -k <filter_key>
sudo ausearch -k <filter_key>

Example:

$ sudo auditctl -w /etc  -p w -k etc
$ sudo touch /etc/test
$ sudo ausearch -k etc
----
time->Tue Apr 21 15:40:36 2015
type=CONFIG_CHANGE msg=audit(1429623636.816:8542): auid=4294967295 ses=4294967295 op="add_rule" key="etc" list=4 res=1
----
time->Tue Apr 21 15:40:45 2015
type=PROCTITLE msg=audit(1429623645.648:8547): proctitle=746F756368002F6574632F74657374
type=PATH msg=audit(1429623645.648:8547): item=1 name="/etc/test" inode=136296 dev=08:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
type=PATH msg=audit(1429623645.648:8547): item=0 name="/etc/" inode=131073 dev=08:01 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
type=CWD msg=audit(1429623645.648:8547):  cwd="/"
type=SYSCALL msg=audit(1429623645.648:8547): arch=c000003e syscall=2 success=yes exit=3 a0=7ffd8f419d9d a1=941 a2=1b6 a3=691 items=2 ppid=7399 pid=7400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="touch" exe="/bin/touch" key="etc"

from man auditctl:

-p [r|w|x|a]
      Describe  the  permission  access  type that a file system watch
      will trigger on. r=read, w=write, x=execute, a=attribute change.
      These  permissions  are  not  the standard file permissions, but
      rather the kind of syscall that would do this kind of thing. The
      read & write syscalls are omitted from this set since they would
      overwhelm the logs. But rather for reads  or  writes,  the  open
      flags are looked at to see what permission was requested.
4
  • what package is auditctl part of?
    – j0h
    Apr 22, 2015 at 17:57
  • 1
    @j0h That's "auditd"
    – A.B.
    Apr 22, 2015 at 17:58
  • 1
    @j0h: If you like the answer, just click the little grey under the "0" now turning it into beautiful green. If you do not like the answer, click on the little grey down-arrow below the 0, and if you really like the answer, click on the little grey checkmark and the little up-arrow...
    – Fabby
    Aug 19, 2015 at 11:42
  • was on vacation
    – j0h
    Aug 21, 2015 at 16:01
1

You can choose tripwire file integrity manager.

http://www.tripwire.com/register/tripwire-enterprise-file-integrity-manager/

http://www.thegeekstuff.com/2008/12/tripwire-tutorial-linux-host-based-intrusion-detection-system/

1
  • For @jOh and others who {have,,will} come up with similar queries, a older but up-to-date and overall better reference than that on thegeekstuff.com above, for Ubuntu 14.04 and tw 2.4.2.2, is brought to you courtesy of: http://www.linuxjournal.com/article/8758?page=0,1.
    – Cbhihe
    Sep 25, 2015 at 20:51
1

Setting immutable attribute on the file would help preventing any changes to it. As for monitoring - you can probably achieve it in many ways starting with some shell script verifying size, checksum, modification time or whatever else you find useful, ending on some more sophisticated integrity checking solutions like tripwire or whatever currently is recommended. For one file it may be a bit overkill, however. (and not sure if tripwire isn't actually currently a bit outdated - may be good anyway to look for this kind of solution if monitoring of changes is required)

And that probably still doesn't exhaust options. :)

5
  • 1
    Not really sure what you mean with that 0777 - but giving world wide permissions isn't probably the best idea?
    – Jacek
    Apr 21, 2015 at 14:55
  • 1
    Aaah, forget it. My mistake. :\
    – A.B.
    Apr 21, 2015 at 15:01
  • 1
    OK - no worries - you thought about sticky bit on the dir, I guess - it's not a good solution anyway, as you know. Of course immutable bit also can be cleared, but only by root - and until then even root can't really modify the file (I guess you know that, but for others)
    – Jacek
    Apr 21, 2015 at 15:02
  • 1
    Well - maybe myself I should rather use anyway "immutable attribute" instead of "immutable bit" to avoid confusion - anyway, for everyone, we're talking here about chattr and its settings. (corrected to immutable attribute in my original answer)
    – Jacek
    Apr 21, 2015 at 15:04
  • I will look up the immutable term.
    – j0h
    Apr 21, 2015 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .