Groups > linux.debian.user > #198726 > unrolled thread

Monitoring copy file security

Started by	Ilyass Kaouam <ilyassikai@gmail.com>
First post	2018-08-13 21:00 +0200
Last post	2018-08-15 00:20 +0200
Articles	10 — 6 participants

Back to article view | Back to linux.debian.user

  Monitoring copy file security Ilyass Kaouam <ilyassikai@gmail.com> - 2018-08-13 21:00 +0200
    Re: Monitoring copy file security Roberto C. Sánchez <roberto@debian.org> - 2018-08-13 21:10 +0200
    Re: Monitoring copy file security Martin <keine-eile@online.de> - 2018-08-13 22:10 +0200
      Re: Monitoring copy file security "Thomas Schmitt" <scdbackup@gmx.net> - 2018-08-13 22:20 +0200
        Re: Monitoring copy file security Martin <keine-eile@online.de> - 2018-08-13 22:40 +0200
          Re: Monitoring copy file security Roberto C. Sánchez <roberto@debian.org> - 2018-08-13 23:00 +0200
            Re: Monitoring copy file security Ilyass Kaouam <ilyassikai@gmail.com> - 2018-08-13 23:40 +0200
              Re: Monitoring copy file security Zenaan Harkness <zenaan@freedbms.net> - 2018-08-14 01:50 +0200
    Re: Monitoring copy file security Reco <recoverym4n@gmail.com> - 2018-08-14 18:10 +0200
      Re: Monitoring copy file security Ilyass Kaouam <ilyassikai@gmail.com> - 2018-08-15 00:20 +0200

#198726 — Monitoring copy file security

From	Ilyass Kaouam <ilyassikai@gmail.com>
Date	2018-08-13 21:00 +0200
Subject	Monitoring copy file security
Message-ID	<wmqel-19z-5@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi,

I have a database server in which I save the database (dump)
let say
 /home/backup directory.
I would like to monitor this directory and find out if anyone is doing a cp
or mv or.....
Any idea?
Thank you very much

[toc] | [next] | [standalone]

#198727

From	Roberto C. Sánchez <roberto@debian.org>
Date	2018-08-13 21:10 +0200
Message-ID	<wmqo1-1rP-1@gated-at.bofh.it>
In reply to	#198726

On Mon, Aug 13, 2018 at 08:52:35PM +0200, Ilyass Kaouam wrote:
>    Hi,
>    I have a database server in which I save the database (dump)
>    let say /home/backup directory.
>    I would like to monitor this directory and find out if anyone is doing a
>    cp or mv or.....
>    Any idea?
>    Thank you very much 

The best tool I have found for this sort of thing is incron.  In my case
I have a requirement that published build artifacts not be accidentally
removed, replaced, etc.  To ensure that, I have incron monitor the
directory where publish mechanism deposits the artifacts and when incron
detects that a file is closed at the conclusion of writing (i.e., when
the copy operation is completed), it changes the permissions to 444 and
sets the immutable attribute.

It sounds like you could do something similar to notify when something
interesting happens or it could even take action.

Incidentally, it has been some time but I recall making an attempt to
use inotify-tools first for my particular solution.  However, it did not
work in the way that I needed it to so I went with incron instead.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#198728

From	Martin <keine-eile@online.de>
Date	2018-08-13 22:10 +0200
Message-ID	<wmrk5-1Zl-1@gated-at.bofh.it>
In reply to	#198726

Am 13.08.2018 um 20:52 schrieb Ilyass Kaouam:
> Hi,
> 
> I have a database server in which I save the database (dump)
> let say
>  /home/backup directory.
> I would like to monitor this directory and find out if anyone is doing a cp
> or mv or.....
> Any idea?
> Thank you very much
> 

There is -or was, quite some time ago I've last seen this- a software called famd (File Alteration Monitor -> https://en.wikipedia.org/wiki/File_Alteration_Monitor). Looks like there is no .deb in a current repo, but may be the name has changes. This software is based on Inotify.

Not sure, if this helps, Martin

[toc] | [prev] | [next] | [standalone]

#198729

From	"Thomas Schmitt" <scdbackup@gmx.net>
Date	2018-08-13 22:20 +0200
Message-ID	<wmrtL-22q-9@gated-at.bofh.it>
In reply to	#198728

Hi,

Martin wrote:
> There is -or was, quite some time ago I've last seen this- a software called
> famd (File Alteration Monitor ->
> https://en.wikipedia.org/wiki/File_Alteration_Monitor). Looks like there is
> no .deb in a current repo, but may be the name has changes.

Maybe this ?
  https://tracker.debian.org/pkg/fam
  https://packages.debian.org/unstable/fam

Last change of the Debian package was two years ago, last change of
upstream version was 15 years ago. (A case of completely finalized
development ? All problems solved ?)

Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#198730

From	Martin <keine-eile@online.de>
Date	2018-08-13 22:40 +0200
Message-ID	<wmrN7-28C-7@gated-at.bofh.it>
In reply to	#198729

Am 13.08.2018 um 22:16 schrieb Thomas Schmitt:
> Hi,
> 
> Martin wrote:
>> There is -or was, quite some time ago I've last seen this- a software called
>> famd (File Alteration Monitor ->
>> https://en.wikipedia.org/wiki/File_Alteration_Monitor). Looks like there is
>> no .deb in a current repo, but may be the name has changes.
> 
> Maybe this ?
>   https://tracker.debian.org/pkg/fam

Oh, yes! How simple. Unfortunately, 'apt-cache search fam' returns 578 hits. 'apt-cache search famd' gives zero. Not that smart naming I guess.

>   https://packages.debian.org/unstable/fam
> 
> Last change of the Debian package was two years ago, last change of
> upstream version was 15 years ago. (A case of completely finalized
> development ? All problems solved ?)

This was made by SGI: Of cause, all problems solved! :-)Man, 15 years ago... But this was quite a cool company.

> 
> Have a nice day :)
> 
> Thomas
>

[toc] | [prev] | [next] | [standalone]

#198733

From	Roberto C. Sánchez <roberto@debian.org>
Date	2018-08-13 23:00 +0200
Message-ID	<wms6t-2fX-3@gated-at.bofh.it>
In reply to	#198730

On Mon, Aug 13, 2018 at 10:30:02PM +0200, Martin wrote:
> 
> Oh, yes! How simple. Unfortunately, 'apt-cache search fam' returns 578 hits. 'apt-cache search famd' gives zero. Not that smart naming I guess.
> 

Try 'apt-cache pkgnames fam' instead.

'pkgnames' considers only package names, where 'search' considers
package names and descriptions.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#198735

From	Ilyass Kaouam <ilyassikai@gmail.com>
Date	2018-08-13 23:40 +0200
Message-ID	<wmsJc-2HD-11@gated-at.bofh.it>
In reply to	#198733

[Multipart message — attachments visible in raw view] — view raw

Thank you for you all,
I will all  this.
For other friends, if you have other suggestions please do not hesitate :)

Le lun. 13 août 2018 à 22:57, Roberto C. Sánchez <roberto@debian.org> a
écrit :

> On Mon, Aug 13, 2018 at 10:30:02PM +0200, Martin wrote:
> >
> > Oh, yes! How simple. Unfortunately, 'apt-cache search fam' returns 578
> hits. 'apt-cache search famd' gives zero. Not that smart naming I guess.
> >
>
> Try 'apt-cache pkgnames fam' instead.
>
> 'pkgnames' considers only package names, where 'search' considers
> package names and descriptions.
>
> Regards,
>
> -Roberto
>
> --
> Roberto C. Sánchez
>
>

-- 
*Ilyass kaouam*
*Systems administrator*
* Mastère européen Manager de Projets Informatiques*

[toc] | [prev] | [next] | [standalone]

#198736

From	Zenaan Harkness <zenaan@freedbms.net>
Date	2018-08-14 01:50 +0200
Message-ID	<wmuKZ-3Pb-1@gated-at.bofh.it>
In reply to	#198735

(Please bottom post.)

I'd have the program creating a file, either change file permissions
after writing, or call/trigger some other/ "external" script (which
you write) to do the tidy ups.

Good luck,


On Mon, Aug 13, 2018 at 11:34:40PM +0200, Ilyass Kaouam wrote:
> Thank you for you all,
> I will all  this.
> For other friends, if you have other suggestions please do not hesitate :)
> 
> Le lun. 13 août 2018 à 22:57, Roberto C. Sánchez <roberto@debian.org> a
> écrit :
> 
> > On Mon, Aug 13, 2018 at 10:30:02PM +0200, Martin wrote:
> > >
> > > Oh, yes! How simple. Unfortunately, 'apt-cache search fam' returns 578
> > hits. 'apt-cache search famd' gives zero. Not that smart naming I guess.
> > >
> >
> > Try 'apt-cache pkgnames fam' instead.
> >
> > 'pkgnames' considers only package names, where 'search' considers
> > package names and descriptions.
> >
> > Regards,
> >
> > -Roberto

[toc] | [prev] | [next] | [standalone]

#198785

From	Reco <recoverym4n@gmail.com>
Date	2018-08-14 18:10 +0200
Message-ID	<wmK3o-4L3-13@gated-at.bofh.it>
In reply to	#198726

	Hi.

On Mon, Aug 13, 2018 at 08:52:35PM +0200, Ilyass Kaouam wrote:
> Hi,
> 
> I have a database server in which I save the database (dump)
> let say
>  /home/backup directory.
> I would like to monitor this directory and find out if anyone is doing a cp
> or mv or.....

apt install auditd

auditctl -a always,exit -F dir=/home/backup -F perm=war

md5sum /home/backup/* # any reading/writing command will do

tail /var/log/audit/audit.log

Reco

[toc] | [prev] | [next] | [standalone]

#198793

From	Ilyass Kaouam <ilyassikai@gmail.com>
Date	2018-08-15 00:20 +0200
Message-ID	<wmPPr-83G-5@gated-at.bofh.it>
In reply to	#198785

[Multipart message — attachments visible in raw view] — view raw

Thank's

Le mar. 14 août 2018 à 18:03, Reco <recoverym4n@gmail.com> a écrit :

>
>
> apt install auditd
>
> auditctl -a always,exit -F dir=/home/backup -F perm=war
>
> md5sum /home/backup/* # any reading/writing command will do
>
> tail /var/log/audit/audit.log
>
> Reco
>
>

-- 
*Ilyass kaouam*
*Systems administrator*
* Mastère européen Manager de Projets Informatiques*

[toc] | [prev] | [standalone]

csiph-web

Monitoring copy file security

Contents

#198726 — Monitoring copy file security

#198727

#198728

#198729

#198730

#198733

#198735

#198736

#198785

#198793