<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Correct.. I just need to know when a new user or group has been
added, I am not planning to monitor the shadow file.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>-Gavin<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Ralph Mitchell
[mailto:ralphmitchell@gmail.com] <br>
<b>Sent:</b> Wednesday, July 08, 2009 10:21 AM<br>
<b>To:</b> hobbit@hswn.dk<br>
<b>Subject:</b> Re: [hobbit] monitoring etc passwd<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Only if passwords are actually stored in /etc/passwd.
Linux systems have been using /etc/shadow to store passwords, along with
last change time and some other things, leaving just the uid, gid, home
directory and shell in /etc/passwd.<o:p></o:p></p>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>Ralph Mitchell<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
<div>
<p class=MsoNormal>On Wed, Jul 8, 2009 at 5:34 AM, Shaun Phillips <<a
href="mailto:tainted.soul69@googlemail.com">tainted.soul69@googlemail.com</a>>
wrote:<o:p></o:p></p>
<p class=MsoNormal>If you do monthly root password changes this is going to
send your entire estate red surely as the MD5 will change?<o:p></o:p></p>
<div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
<div>
<p class=MsoNormal>On Wed, Jul 8, 2009 at 9:02 AM, dOCtoR MADneSs <<a
href="mailto:doctor@makelofine.org" target="_blank">doctor@makelofine.org</a>>
wrote:<o:p></o:p></p>
<p class=MsoNormal><a href="mailto:rsmrcina@wi.rr.com" target="_blank">rsmrcina@wi.rr.com</a>
a écrit : <o:p></o:p></p>
<div>
<div>
<blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;
margin-left:4.8pt;margin-right:0in'>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Gavin,<br>
<br>
Use the FILE client check to determine and possibly alert when a file
(/etc/passwd) has been changed.<br>
<br>
---- Gavin Leonard <<a href="mailto:gleonard@progrexion.com" target="_blank">gleonard@progrexion.com</a>>
wrote: <o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Hi All,<br>
I am having a problem
where users and groups are being created without the knowledge of the admin
team and its making it difficult to know who had access to what systems if they
leave the company... is there a way for hobbit to tell me when the /etc/passwd
or /etc/group files change? Thanks in Advance..<br>
<br>
-Gavin<br>
<br>
<br>
<o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
<br>
To unsubscribe from the hobbit list, send an e-mail to<br>
<a href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank">hobbit-unsubscribe@hswn.dk</a><br>
<br>
<o:p></o:p></p>
</blockquote>
</div>
</div>
<p class=MsoNormal>Hi,<br>
<br>
In client-local.cfg :<br>
[your_host]<br>
file:/etc/passwd<br>
in hobbit-clients.cfg :<br>
HOST=your_host<br>
FILE /etc/passwd red MD5=9780JNLKNoiulknaée2<br>
<br>
Those settings should do exactly what you need <o:p></o:p></p>
<div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
<br>
To unsubscribe from the hobbit list, send an e-mail to<br>
<a href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank">hobbit-unsubscribe@hswn.dk</a><br>
<br>
<o:p></o:p></p>
</div>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</div>
</body>
</html>