File watch on group

File watch on group

[Ameel Kamboh]

[-- Attachment #1.1: Type: text/plain, Size: 606 bytes --]

I would like to put a watch on a file for rwxa for a 
File being accessed by someone who is not in the same group as the file.

For example:
  I have a file /var/myapp/logs    640 ntsw:ntsec 
 
So basically I have my application log files that are readable by anyone
in the ntsec group.
However if someone in another group like ntadm group tries to rwxa that
file I would like to log it.

Can this be done using an audit rule?

Ameel Kamboh
SIP Core Network and Security 
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh@techtrial.com
email: akamboh@nortel.com




[-- Attachment #1.2: Type: text/html, Size: 2147 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: File watch on group

[Steve Grubb]

On Wednesday 18 July 2007 05:46:40 pm Ameel Kamboh wrote:
> I would like to put a watch on a file for rwxa for a
> File being accessed by someone who is not in the same group as the file.
>
> Can this be done using an audit rule?

On RHEL5 or 2.6.19 or higher:

auditctl -a exit,always -S all -F perm=rwxa -F gid!=root 
 -F path=/etc/localtime -k gid-rule

and to see results:

ausearch --start today -k gid-rule

The only limitation is that you need to know the group beforehand.

-Steve