You can monitor directories permission with incron + inotify.
Set a watch on public_html
folder for auditing:
# auditctl -w /path/to/public_html -p warx
Install incron
and create a configuration file to monitor all
subdirectories in public_html
:
find /path/to/public_html -type d -print0 | xargs -0 -I{} echo "{} IN_ATTRIB sendmail.sh" >> /etc/incron.d/webroot.conf
sendmail.sh
including a simple line as belows:
#!/bin/bash
echo "`date +%c`" | mail -s "someone has changed permission in public_html" [email protected]
Whenever someone change permission, it will email to you. Login to your server and check who has made changes with ausearch -f /path/to/public_html
, you will see something like this:
time->Mon Aug 8 01:12:41 2011
type=PATH msg=audit(1312740761.563:2279002): item=0 name="/var/www/html/awstats/" inode=1732554 dev=08:03 mode=040775 ouid=48 ogid=48 rdev=00:00
type=CWD msg=audit(1312740761.563:2279002): cwd="/var/www"
type=SYSCALL msg=audit(1312740761.563:2279002): arch=c000003e syscall=90 success=yes exit=0 a0=14cb0d0 a1=1b4 a2=ffffffb6 a3=1b4 items=1 ppid=12660 pid=12901 auid=510 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=pts1 ses=360563 comm="chmod" exe="/bin/chmod" key=(null)
Pay attention to uid
and gid
.