URGENT HELP NEEDED - How do I check who accessed a file ?

[Rudi Martin]

Hi there

I need to know how to check who accessed and tampered with a specific file on my system.

For example , let's say someone changed the /etc/password file , how can I check which user did it ?

Thanks

[Mark Grant]

THe only way to do that is to check any auditing logs you have. users .sh_history is a good one. su logs too.

If you are running a trusted system then I believe there a many more auditing logs you can look at.

[Bharat Katkar]

Hi,
in addition to that check with "last" command to reveiw login's history.
# last -R
this will give you IP Addresses as well.

Regards,

[Darren Prior]

Hi,

There are a number of security applications out there that could do this, otherwise you could enable auditing on a trusted system but this tends to produce a lot of data that you will have to sift through.

If it's the passwd file that you're worried about, then remember that people will be able to change their own entry when they change their password. If you're worried about someone changing other parts of the file then you need to reconsider who has access to the root password.

regards,
Darren.