Linux System File Change monitoring

Xinlu Although there are many bastion hosts that can record commands executed by SA or other departments on the server, there are still some issues that cannot be recorded. For example, if a script or binary program was uploaded one month ago, it is difficult to execute and delete some files. Even if you deploy an ossec or other HIDS system on the server, you cannot perform too many round-robin queries on the file status in a short period of time due to performance considerations. Here we will introduce three simple methods with their respective strengths. First, replace shell. Use a script language such as perl to write a shell, replace bash and cshell, and set it to the user's default shell. In this shell, you can record three files, modify files, and other operations to facilitate future tracing. The advantage is that the implementation is simple and the risk is low. The disadvantage is that it is easy to bypass and cannot record the operations performed by the binary program on files. The second method is to write the hook system call and monitor file operations. The advantages and disadvantages of this solution are obvious. The advantage is that the underlying layer is not easy to bypass. The disadvantage is that it is highly risky, versatile, and difficult to develop. Although the new linux kernel provides interfaces such as kprobe for convenient hook, there is always no user-like state to implement. In addition, it is possible to upgrade the kernel. It is basically impossible to upgrade the kernel for this purpose. The third method is to use inotify to monitor file changes. Inotify is event-based monitoring. It does not require regular file status polling or kernel module hook system calling, which is simple and reliable. It is better to record the current login user and the processes started by the current user when detecting file changes. However, inotify requires support for kernel 2.6.13 and later. RHEL5 is available by default, and other systems are not sure. In my opinion, this is the best implementation.