Join Log in
Score:2
avatar Server

Periodically audit file permissions for mistaken leaks

in flag
pufferfish

I'm looking for a way to periodically check a file system tree for permissions that have been set incorrectly.

The context is:

  • this is in an academic compute environment, with students, researchers and overworked sysadmins
  • the focus is not on malicious actors, but rather mistakes made by any of the above
  • existing users/group hierarchy
  • prevention does not have to be immediate, we're thinking of something that can run daily
  • ideally don't want to have to install extra tools such as tripwire
  • don't need a forensic trail to be captured

My hunch is a script that:

  • runs daily via cron
  • runs as a user with read permissions for the entire tree
  • checks that rwx is off for the "all" bits.. (more rules to be added)

Before I start this, is there an established way to do this that I'm not aware of?

168
0 + 0
in flag
Mario
You could simply override permissions via `chmod` in a cron script, this way wrong permissions will get changed only. Or an other approach to set permissions is to set a sticky-bit for the parent directory and this will have priority over the file-rights.
0
Reply
Score:3
avatar Server
jp flag
AlexD

You want to check AIDE or mtree

More generic list of File integrity monitoring software

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.