9

I'd like to follow up my A Brief Introduction to auditd with something similar to what we did with this question Simple example auditd configuration?.

So in the answers please spec out what you want to accomplish and I'll try to build out an auditd config to match and publish it on the blog.

6

I have an assignment to provide auditd monitoring for a client's server.

The customer has a production Linux server running an ERP application whose source code resides on the server. The standard practice for this product is for programmers to make ad-hoc changes to the code on the production system!!

The client has established a dedicated test environment on another server and would like for me to monitor three specific directories on the production system for changes to the source code and compiled executables. They've had bad code pushed into production in the past, but there was no audit trail/accountability. This is how they would like to enforce the wall between test and production.

The final requirement is for auditd to sense automatic email notification of changes to the monitored directories.

Please halp!!

8
  • What the hell is wrong with using version control? – mfinni Sep 20 '13 at 14:30
  • This application is custom and unique to each customer's environment. There is no notion of source control or versioning here... – ewwhite Sep 20 '13 at 14:41
  • Not a valid answer, IMO – mfinni Sep 20 '13 at 14:55
  • 2
    @mfinni The client has no control over this. The software vendor isn't going to change because: incompetent. We're looking for a way to identify when files are modified for our own records. – ewwhite Sep 20 '13 at 17:24
  • Ah, I assumed this was home-grown code. didn't realize the people making changes were a vendor. – mfinni Sep 20 '13 at 17:26
  • 1
    This sounds like a question for Unix & Linux. Do you really need a secure solution, though (i.e. to have monitoring that non-root users can't spoof)? In your scenario, it looks like a cooperative solution (e.g. based on inotify) would be good enough. Anyway, be sure to indicate that in your question. – Gilles 'SO- stop being evil' Sep 21 '13 at 12:53
  • 1
    @gilles Heh, I never go to that weirdo Unix site ;) the solution does not need to be tremendously secure, but the audit trail needs to remain intact. – ewwhite Sep 21 '13 at 14:02
  • 1
    This has been written up and set to be published Friday morning. – Scott Pack Sep 26 '13 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .