1

In my Ubuntu box, I need to monitor which script/program/user is creating files in a path or its sub-directories.

The main idea being to identify a possible yet unknown security hole that is being exploited to inject malicious scripts in my system.

I think it can maybe be possible with linux's INotify? Ive tried to find such a script without luck.

Can somebody suggest me a simple script to do it?

Thanks

zed_0xff
  • 32,417
  • 7
  • 53
  • 72
arod
  • 13,481
  • 6
  • 31
  • 39
  • look at tripwire, solidcore, samhain, iwatch -- they may do what you want. also see here: http://stackoverflow.com/questions/3977890/monitor-directory-listing-for-changes – ChuckCottrill Oct 29 '13 at 18:48
  • @ChuckCottrill thanks very interesting stuff. I'll try iWatch... – arod Oct 29 '13 at 23:32

1 Answers1

1

Thanks to @ChuckCotrill, I finally went with

nohup iwatch -r -e create,delete,close_write -t .ext /my/path > /tmp/files_changed.out &

tail -f /tmp/files_changed.out
arod
  • 13,481
  • 6
  • 31
  • 39