Any log file for checking file permission change history in RHEL 5.1?

bilalcochin · 04-02-2010, 07:07 AM

Hello,

Which log file is used to check file permission changes in RHEL 5.?

Example:-
Redhat server with 20 users all are sudo permissions.
Sometime some users changing the file permission using chmod, chowm etc commands. And delete the content of .bash_history file.
How to check the previous file permissions?

Thanks in advance

frndrfoe · 04-02-2010, 08:04 AM

If you are running Audit you may be able to did up the information, otherwise I do not know of anything besides checking the file with stat and seeing who was logged in during the last "change" time (unless the permissions have been changed again since).

fpmurphy · 04-02-2010, 09:18 AM

Depending on how you configured sudo, you may or may not be be logging all sudo commands. The dafault location for the logfile is /var/log/sudolog.

trobbelke · 04-02-2010, 09:57 AM

we use a perl script that mails me the complete history of every user every time they logout. That way they can't hide their activities, I can check who did what on all our systems.