2

Is there a way I can check the date that a linux group was created and/or modified? It would be even better if I could pull the last user to modify the group.

Improve this question
1
  • Not really, you may want to install something like etckeeper on your box so you can find this out in the future. It stores changes to /etc/ in your favorite DVCS.
    – Zoredache
    Aug 30, 2010 at 19:26

3 Answers 3

Reset to default
1

Assuming we're talking local files here (not LDAP) and no additional auditing software, you're pretty much limited to the metadata of /etc/group; you can see when the file was last modified, but not by whom or which group(s) was affected.

Improve this answer
1
  • James, Prix, you are assuming that the groupadd / groupdel commands are used. /etc/group format is trivial, and this file is often simply edited by hand. Also, process accounting is a heavyweight solution as it will have a system-wide performance impact. If complete group auditing is required, it might be better to implement LDAP and using the auditing facilities of the LDAP server. Then use an automated process such as tripwire to ensure the /etc/group isn't modified.
    – Urgoll
    Aug 31, 2010 at 14:08
1

Just look in /var/log/secure, I created and modified a group as an example. Please note that the command may not relate to the last session opened, so could be difficult to tell who actually did it:
Aug 30 20:38:09 aladdin su: pam_unix(su-l:session): session opened for user root by james(uid=0)
Aug 30 20:38:15 aladdin groupadd[2442]: group added to /etc/group: name=test, GID=501
Aug 30 20:38:15 aladdin groupadd[2442]: group added to /etc/gshadow: name=test
Aug 30 20:38:15 aladdin groupadd[2442]: new group: name=test, GID=501
Aug 30 20:39:03 aladdin groupmod[2450]: group changed in /etc/group (group test/501, new gid: 502)
Aug 30 20:39:03 aladdin groupmod[2450]: group changed in /etc/passwd (group test/501, new gid: 502) And yes, my machine is called aladdin - what of it?

Improve this answer
1
0

You can see the last commands using the lastcomm for that you must have acct enabled, by adding the follow to your init script:

# Turn process accounting on. 
if [ -x /sbin/accton ]
then 
        /sbin/accton /var/log/pacct 
        echo "Process accounting turned on." 
fi

To create the accounting record file:

touch /var/log/pacct
chown root /var/log/pacct
chmod 0644 /var/log/pacct

One thing i can recommend you to do is to alter both your groupadd and groupdel, move it somewhere else and create 2 bash scripts that will store the user that summoned it, the time and the command and after that it will call the actual scripts to create the groups or deleted them.

A small sample: mv /usr/sbin/groupadd /usr/sbin/new_groupadd

Now create a new /usr/sbin/groupadd with the follow content (dont forget to chmod it after youre done):

#!/bin/bash

echo "`date` - $USER - /usr/sbin/new_groupadd $@" >> /var/log/group_log
/usr/sbin/new_groupadd $@

Create the record file:

touch /var/log/groupadd_log
chown root /var/log/groupadd_log
chmod 0644 /var/log/groupadd_log

Well pointed by James Lawrie look in /var/log/secure and all it is rotated files (if the entry is too old already) to find out about when it was last changed, but it will not list if you give users other then root access to add groups.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .