Looking for app/service to silently capture file changes in website (like SVN but automatic check-in) for auditing purposes [closed]

Question

Here's the background to my question:

A number of people deploy changes to our ASP.NET website ... designers deploy HTML and CSS changes, .NET developers deploy ASPX, DLL files, graphic designers deploy images, etc etc.

In theory all these deployments are done in a very controlled way - source code is maintained in SVN, deployment packages are created and version controlled, deployments are tested first on a pre-production site, deployments to live are documented. In theory we always know what files were changed, when, why & by who.

However, sometimes someone makes a change directly on the live site and bypasses all the procedures. Usually this is because of some emergency. Sometimes a change is made that causes a problem on the site ... and no-one owns up to it!

So what we are looking for is some kind of unattended service that captures all file changes to specific folders on the server. It should "check in" file changes as they happen, i.e. capture the new version of the entire file, and also capture the Windows login of the user. In other words, every file gets a history of changes made to it, just like SVN, TFS etc. We should be able to do a diff between versions in the file's history. 99% of what it captures should be changes made through the proper procedures - but it should also contain the 1% that are not.

To be clear - we are not looking for a service that sends "file integrity" alerts, like OSSEC. We just want every file change to be captured, so in the event of something going wrong we can check the change log and figure out what was done outside of the usual procedures. Also, it obviously should be completely automated - requiring the users to follow an additional procedure is not what we are after here !

Also, periodically taking backups and then looking for differences between them is not what we want, because this would not tell us who made the change.

Answer 1

I've dealt with similar issues through day jobs and several clients alike.

The issue here is basic permissions and separation of job duties. You need a procedural change much more than a software tool. There should only be a very small number of people capable of performing a push of content like this to production. It varies depending on the organisation but from what I've seen in the small business market under 15% of the people that make changes to the website in development have access to push to production. That would generally include the head developer, head marketing / image person, head of IS and (possibly) a secondary trusted developer.

All that being said I would suggest auditing windows logon events. Once you've narrowed down the people that have access this provides an easy way to say who was accessing the system at the time of the change. You can also use file system auditing (for changes) on the directory that hosts your website's files. It doesn't capture the original content but it's relatively quick and easy to set up.

Answer 2

Since you already use SVN, set up another repository and a scheduled task to check in site contents there. A hourly incremental backup job would work too.