Mod Removes Wiki by schroeder
2 activate link
source | link

Two different approaches could be used.

File integrity monitoring.

Host based intrusion detection software such as AIDE can be configured to record hashes of important files on the system and then perform periodic scans to report on files that have changed. In your case, if the contractors sometimes have root access, some steps would need to be taken to ensure they could not modify the hashes to avoid changes being detected.

Audit logging

The Linux auditdauditd Daemon can be configured to log all commands run by an administrator. As described in this question; Inhttps://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-serversIn https://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-servers

In this case it would be wise to use syslog to send the logs to a remote server that the contractors do not have access to in order to.prevent prevent them tampering with the logs.

Two different approaches could be used.

File integrity monitoring.

Host based intrusion detection software such as AIDE can be configured to record hashes of important files on the system and then perform periodic scans to report on files that have changed. In your case, if the contractors sometimes have root access, some steps would need to be taken to ensure they could not modify the hashes to avoid changes being detected.

Audit logging

The Linux auditd Daemon can be configured to log all commands run by an administrator. As described in this question; Inhttps://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-servers

In this case it would be wise to use syslog to send the logs to a remote server that the contractors do not have access to in order to.prevent them tampering with the logs.

Two different approaches could be used.

File integrity monitoring.

Host based intrusion detection software such as AIDE can be configured to record hashes of important files on the system and then perform periodic scans to report on files that have changed. In your case, if the contractors sometimes have root access, some steps would need to be taken to ensure they could not modify the hashes to avoid changes being detected.

Audit logging

The Linux auditd Daemon can be configured to log all commands run by an administrator. As described in this question; In https://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-servers

In this case it would be wise to use syslog to send the logs to a remote server that the contractors do not have access to in order to prevent them tampering with the logs.

1
source | link

Two different approaches could be used.

File integrity monitoring.

Host based intrusion detection software such as AIDE can be configured to record hashes of important files on the system and then perform periodic scans to report on files that have changed. In your case, if the contractors sometimes have root access, some steps would need to be taken to ensure they could not modify the hashes to avoid changes being detected.

Audit logging

The Linux auditd Daemon can be configured to log all commands run by an administrator. As described in this question; Inhttps://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-servers

In this case it would be wise to use syslog to send the logs to a remote server that the contractors do not have access to in order to.prevent them tampering with the logs.

    Post Made Community Wiki by Anthony the Engineer