Home / ubuntu / Questions / 513954
In Process
Miphix
Asked: 2014-08-21 11:04:50 +0800 CST

How do you detect file changes

  • 772

Since Linux is vulnerable to a number of similar vulnerabilities as windows. I'm trying to find a daemon that catalogs and alerts me/user of any and all file changes as well as file additions. Is there one out there or do I have to make one of my own?

security

1 Answers

  1. What you want is an intrusion detection system. I've used AIDE comfortably for a while, it can send a daily e-mail report with changes to files, for you to review.

    http://aide.sourceforge.net/

    Another possibility is samhain, I just found it by doing apt-cache search intrusion.

    These are only two choices, but there are many more, so you will likely not need to roll out your own.

    OH and there's also Tripwire, the granddaddy of all these pieces of software, though it appears to have gone "freemercial": http://www.tripwire.org/

    • 6