I´m looking for a simple way to monitor critical folders for changes to recognize hacks on a ubuntu 12.04 server. After Days of reading How To´s on different programms I´m a bit confused which way to go. The candidates I´ve googled so far are:
- Tripwire
- Samhain
- Iwatch
- Ossec
As written all I need is a not ressource intense way to check if something changed on my system (if so send an emai).
Beside the 4 solutions I´ve read that Linux gives you already the possibility to monitor and inform about file changes with Upstart. It´s already included within ubuntu what makes it glittering for me. Unfortunately I couldn´t find any How to´s for Upstart file monitoring.
Last but not least, I could also imagine to set up a simple cronjob which compares f.e. the size of critical folders with a given size.
Thankful for pointing me in the right direction,
tony