0

Is there a way to view all of the times a files ownership changed? I have a feeling there is a security issue on my server, however I am also very paranoid and may have changed it myself.

Richard Christensen
  • 111
  • 2

2 Answers2

1

You should use auditd for that purpose. It is special kernel module for auditing syscalls. You can configure it for listing on special syscalls via special userspace utilities.

Also you can get more interesting info in benchmarks from CIS. For example this.

user2986553
  • 390
  • 1
  • 4
0

I think the stat command is going to be about the best you're going to get.

http://linux.die.net/man/1/stat

You may want to investigate and set up intrusion detection systems to be certain.

http://www.tldp.org/HOWTO/Security-Quickstart-HOWTO/intrusion.html

erimar77
  • 488
  • 2
  • 8