I need help deploying an application on my Amazon Linux server and the remote worker that I'm working with will likely need to be provided with root-level access. I've never provided anyone else access to my server, so am worried about how to track changes that are made.

Monitoring bash / commands:

I've considered using ~/.bash_history to monitor command-line changes, but it doesn't list the directories from which the commands are coming, so I'm not sure it's a complete solution

Monitoring changes to files / directories:

I'm looking for something like git but for the whole system... Is there a way of doing this? From what I've read, running 'git init' at / is not a viable option.

What are good ways of monitoring / logging changes at the user level across the server ?

  • 2
    Look into the Linux audit framework and/or /etc/sudoers. bash_history can be easily deactivated, this is not an option at all. Final rule: If you don't trust someone, don't give them root access. – Sven Dec 23 '15 at 1:12

Running auditd would probably work for you (assuming you configure sudo for the worker to not allow him/her to disable it).

See http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.