Hi ,
I want a script who will send alert the moment someone edit any file in a directory in LINUX. Can some one throw some light on this please.!!
OSes often bring auditing or intrusion detection systems along to handle this. Maybe set up something like tripwire or whatever is commonly used on the OS you are using.
Thanks zaxxon...i am using centos [LINUX]...And i don't want to use tripwire or such for this. Is there any wayout in shell script to trigger alert at the moment config files is modified...?
One approach could be a script, that runs as a demon in the background and compares a list of files with their unmodified status (cksum?) and checks if anything changes. Has to run as root and makes no sense if the other users are also using the root account of course.
The list also needs to be updated in case there is any legal change to the files in a way, that daemon running in the background knows it is a legal change.
This would also only work when the file is already written.
To notice when any of the files in that directory are opened for a write might be more tricky and not be to handle by a shell script.
In your case I would use one of the already existing softwares or auditing.
There is also Samhain/Beltane which is a host-based intrusion detection system too. IMHO it doesn't make much sense to try to program somthing in shell code what someone has already written in a higher programming language as a complete and mature package.
Shell code has its limitations, it was never intended as an application programming device and it is only fit for this purpose up to a point.
There is a way to do what you want on a rather low level: intercept the respective system calls (fopen(), etc.) and build these interceptions into a library, then use this library as PRELOAD. You might want to compare with "Snoopylogger" which uses this same method to intercept execve() calls. As feasible as such a method would be it will not be possible to do it in shell at all, though.
I hope this helps.
bakunin