0

Using Samhain File Integrity Monitoring, I'm trying to monitor changes to the crontab entries. I added the below entry to /etc/samhain/samhainrc 

dir=/var/spool/cron/crontabs

then I added an entry to the root account at /var/spool/cron/crontabs/root and when I try to do Samhain -t check, Samhain does not report the changes. It works when I try with any other file. any help?

Improve this question
3
  • the directory where are cron files is /var/spool/cron
    – Romeo Ninov
    Feb 6, 2019 at 16:12
  • Yes, I missed cron in the question.
    – Sudharsan Sivasankaran
    Feb 7, 2019 at 7:41
  • You do not get my point, please check my answer
    – Romeo Ninov
    Feb 7, 2019 at 7:46

1 Answer 1

Reset to default
0

You should define the directory on this way:

dir=/var/spool/cron

And reconsider the monitoring of this directory because cron jobs change in normal circumstances. On Ubuntu 16... the line should be:

dir=/var/spool/cron/crontab

If you want to monitor particular cron use config like:

file=/var/spool/cron/root

Ubuntu:

file=/var/spool/cron/crontab/root
Improve this answer
2
  • Thanks, I want to monitor the root's crontab, is any other better way to do it?
    – Sudharsan Sivasankaran
    Feb 7, 2019 at 10:55
  • You will better monitor the file, not directory. See my edited answer
    – Romeo Ninov
    Feb 7, 2019 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .