Option to monitor files for acecss

Question

Option to monitor files for acecss

kushaldas opened this issue 5 years ago · comments

We want to monitor certain file access. For example, which all processes are trying to access ~/.ssh directory? Or any other credential/files on the system. The user will specify a list of files.

Why?

Because after getting into the system, people always tries to access important documents, including passwords, logs, emails.

Kushal Das · Answer 1 · Sat Feb 01 2020 00:29:03 GMT+0800 (China Standard Time)

Initial experiments showing that using auditd will be better/easier to monitor file access, and we can monitor auditd logs to notify the users.

Micah Lee · Answer 2 · Sat Feb 01 2020 01:17:27 GMT+0800 (China Standard Time)

I've used watchdog once for something similar and it worked well. If the file monitoring is happening in python, that might be a good choice?

Kushal Das · Answer 3 · Mon Feb 03 2020 22:36:05 GMT+0800 (China Standard Time)

I've used watchdog once for something similar and it worked well. If the file monitoring is happening in python, that might be a good choice?

I found only auditd is capable of telling us about the process which is accessing the files/directories. None other userspace tool was being able to do so.