[hobbit] monitoring etc passwd

[dOCtoR MADneSs]

rsmrcina at wi.rr.com a écrit :
> Gavin,
> 
> Use the FILE client check to determine and possibly alert when a file (/etc/passwd) has been changed.
> 
> ---- Gavin Leonard <gleonard at progrexion.com> wrote: 
>> Hi All,
>>                 I am having a problem where users and groups are being created without the knowledge of the admin team and its making it difficult to know who had access to what systems if they leave the company... is there a way for hobbit to tell me when the /etc/passwd or /etc/group files change? Thanks in Advance..
>>
>> -Gavin
>>
>>
>>
> 
> 
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
> 
> 
Hi,

In client-local.cfg :
[your_host]
file:/etc/passwd
in hobbit-clients.cfg :
HOST=your_host
FILE /etc/passwd red MD5=9780JNLKNoiulknaée2

Those settings should do exactly what you need