<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 22/04/13 20:53, Ralph Mitchell
wrote:<br>
</div>
<blockquote
cite="mid:CAAEjoCXtcqcp_f5c6KW-Ny-P2gAEnnp7OkEuWy5YiP4XJQgA9Q@mail.gmail.com"
type="cite">
<p dir="ltr">You might want to talk to your security people before
copying the passed file to another system, and you *definitely*
should not copy the shadow file. There are good reasons that
file is readable only by root.</p>
<p dir="ltr">Ralph Mitchell</p>
<div class="gmail_quot<blockquote class=" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="MARGIN:4px 4px 1px;FONT:10pt Tahoma">
<div>If you want to monitor changes to the passwd/shadow file,
one way would be to write an ext script. One can get around
the OS recording changes to users by just editing the files
directly, so this would be a bit more foolproof. <br>
</div>
<div>You'd need be to keep a copy of the passwd file somewhere
else (say the xymon server itself) and then do a diff
against it. Something like:</div>
<br>
</div>
</div>
</blockquote>
<br>
I've been watching this thread, but maybe I missed it...<br>
<br>
Doesn't xymon allow to calculate the MD5 of a file and alert if it
is modified..... I'm pretty sure this is a standard feature. Here it
is:<br>
# - "MD5=md5sum", "SHA1=sha1sum", "RMD160=rmd160sum"
trigger a warning<br>
# if the file checksum using the MD5, SHA1 or RMD160
message digest<br>
# algorithms do not match the one configured here.
Note: The "file"<br>
# entry in the client-local.cfg file must specify
which algorithm to use.<br>
<br>
Surely this would generate an appropriate alert if the file is
modified... and continue to alert until the xymon config was updated
with the new checksum.<br>
<br>
Regards,<br>
Adam<br>
<br>
<pre class="moz-signature" cols="72">--
Adam Goryachev
Website Managers
<a class="moz-txt-link-abbreviated" href="http://www.websitemanagers.com.au">www.websitemanagers.com.au</a>
</pre>
</body>
</html>