Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.

Is there a list of important OS files (windows/linux) that must be monitored (by best practice)? I am familiar with Linux but not with windows so I can't seem to find what binaries and/or config files to monitor as a best practice.

share|improve this question
    
You need to monitor all the files including /proc. –  Andrew Smith Jul 17 '12 at 8:07
1  
have a look at what tools like chkrootkit, tiger, rkhunter do -- basically you should check almost everything that is not intended to change –  mdo Jul 17 '12 at 10:07

4 Answers 4

up vote 4 down vote accepted

You should monitor (nearly) all the files.

Assuming that this system is just a hash database, then there are some files you should skip:

  • everything in /proc (there's a lot of useful stuff in here for root kit hunters though)
  • log files (there are tools will will do heuristic analysis of these files)
  • files which contain filesystems (this would include loop-back filesystems and database files - but you probably want to check the 'files' inside the file).
  • swap space

(the difficult bit is setting up a process for auditing the changes properly)

share|improve this answer
    
Thanks, do you know of similar places for Windows systems as well? or do we just monitor everything in C:\windows ? –  george_h Jul 17 '12 at 9:18
    
@george_h - Just monitor any system folder, but also user data, if your only interested in Windows suggestions remove the reference to Linux. –  Ramhound Jul 17 '12 at 11:39
    
Interested in both, I got good linux examples, was waiting to see for some windows ones. –  george_h Jul 17 '12 at 11:50
    
Off the top of my head, the problem with Windows would be that the registry is stored in a database - so you need to maintain hive extracts in order to isolate specific changes. Other than that and swap I don't think there's complications wrt files as handles to data structures (BTW, forgot to mention - do be careful you don't try to get checksum for device files in Linux!) –  symcbean Jul 17 '12 at 16:02

Not sure what file integrity monitoring system you're using, but most commercial file integrity monitoring systems such as Verisys and Tripwire can be configured to 'automatically' monitor the relevant files.

For example, you tell them you're running Windows Server 2008 and Microsoft SQL Server 2008, and then they monitor applicable files and registry entries.

share|improve this answer

For windows platform, microsoft provides the sfc utility. It will check the integrity of all or selected system files and repair them if needed. You can check its options by typing in command prompt: sfc /?

share|improve this answer

There is an open source file integrity monitor called Mugsy that ships with a list of important directories to monitor for Linux:

- /boot
- /lib
- /lib64
- /sys
- /bin
- /sbin
- /usr/bin
- /usr/sbin
- /usr/local/bin
- /usr/local/etc
- /usr/local/sbin
- /etc

I'm the developer of Mugsy, so shameless plug.

I agree that all files should be monitored, but it can be difficult to manage, so you should at least start your monitoring somewhere. I'm hoping we can collaborate on a standard list of what to monitor for Linux and Windows or a list of what to exclude, e.g. temp files that change often.

Also, Mugsy is Linux-specific, but could be built for Windows.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.