|
Actions:
|
2011-12-16 10:13 AEST by Arthur Barrett - In Red Hat Linux 5 (and later) the 'auditctl' command is available to 'watch' changes to configuration
files.
During RPM install we should do a simple 'test' for auditctl, and if it is installed then configure 'watches'
on the CVS Suite Server configuration files:
/etc/cvsnt/PServer
/etc/cvsnt/server
/etc/cvsnt/Bugs
/etc/cvsnt/Make
/etc/cvsnt/cvsmanager
The only 'hiccup' is that we don't actually 'install' these files (the user is supposed to create them from
the templates). So in this case we may need to 'test' for the existance of each file, if it doesn't exist then
create it from the template.
Other things that could be 'watched' include:
/etc/cvsnt/License
/etc/pam.d/cvsnt
/etc/init.d/cvslockd
/etc/init.d/cvsmanager
/path/to/repo/CVSROOT/passwd
/path/to/repo/CVSROOT/group
/path/to/repo/CVSROOT/admins
/path/to/repo/CVSROOT/users
Creating 'watches' on the repo would be more difficult - I wonder if there is some API of if the idea is
just to write directly to audit.rules? I can see some references to audit_add_rule() in libaudit.h
http://linux.die.net/man/3/audit_add_rule
A quick google shows that auditd seems to be available on solaris and mac os x as well, but this is
based on the Solaris API (security/auditd.h) and the OpenBPM API from McAfee and is really just an API
to syslog(). |