How to Monitor File Permissions Changes on Linux Server

How to Monitor File Permissions Changes on Linux Server

Monitor file permissions changes to track permission modifications, detect unauthorized changes, and maintain security compliance. This guide shows you how to monitor file permissions and set up automated monitoring.

For comprehensive file integrity monitoring, see File Integrity Monitoring. For related security topics, see Server Security Audit.

Why Monitoring File Permissions Matters

File permission changes can indicate security breaches, unauthorized access, or configuration errors. Monitoring permission changes helps detect security issues early and maintain security compliance.

Method 1: Monitor File Permissions with find

Find Files with Unusual Permissions

# Find files with world-writable permissions
find /etc -type f -perm /o+w -ls

# Find files with setuid/setgid
find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls

# Find files with unusual permissions
find /etc -type f ! -perm 644 -ls

# Find directories with unusual permissions
find /etc -type d ! -perm 755 -ls

Track Permission Changes

# Monitor permission changes in /etc
find /etc -type f -mtime -1 -exec stat -c "%a %n" {} \;

# Compare permissions over time
find /etc -type f -exec stat -c "%a %n" {} \; > /tmp/permissions_baseline.txt
# Later compare:
find /etc -type f -exec stat -c "%a %n" {} \; | diff /tmp/permissions_baseline.txt -

Method 2: Monitor File Permissions with stat

Check File Permissions

# Check specific file permissions
stat /etc/passwd | grep Access

# Get permission details
stat -c "%a %n" /etc/passwd

# Check multiple files
for file in /etc/passwd /etc/shadow /etc/sudoers; do
  stat -c "%a %n" $file
done

Method 3: Automated Permission Monitoring with Zuzia.app

Set up automated monitoring to track file permissions continuously and receive alerts when permissions change or unusual permissions are detected.

Step 1: Add Permission Monitoring Command

1. Log in to Zuzia.app Dashboard

   • Access your Zuzia.app account
   • Navigate to your server
   • Click "Add Scheduled Task"

2. Configure Permission Check Command

   # Find files with world-writable permissions
   find /etc -type f -perm /o+w | wc -l
   

   • Set execution frequency (every 30-60 minutes)
   • Configure alerts when unusual permissions detected

Step 2: Configure Alert Thresholds

• Warning: Files with world-writable permissions found
• Critical: Critical files with unusual permissions
• Emergency: Multiple permission changes detected

Step 3: Monitor Critical Files

Add commands to monitor critical system files:

# Check critical file permissions
stat -c "%a" /etc/passwd /etc/shadow /etc/sudoers

Best Practices for Permission Monitoring

1. Monitor Critical System Files

• Track permissions for /etc directory files
• Monitor system binary permissions
• Watch security-related files
• Alert on permission changes

2. Set Up Baseline Monitoring

• Establish permission baseline
• Document authorized changes
• Update baseline after authorized changes
• Compare current state with baseline

3. Monitor Permission Changes

• Track permission modifications
• Alert on unusual permissions
• Monitor setuid/setgid files
• Verify file ownership

4. Implement Change Management

• Document all permission changes
• Require authorization for changes
• Review change logs regularly
• Investigate unauthorized changes

Troubleshooting Permission Issues

Step 1: Identify Permission Problems

When permission issues are detected:

# Check file permissions
stat -c "%a %n" /etc/passwd

# Find files with unusual permissions
find /etc -type f -perm /o+w -ls

# Check permission changes
find /etc -type f -mtime -1 -exec stat -c "%a %n" {} \;

Step 2: Resolve Permission Issues

Based on investigation:

1. Fix Unusual Permissions:

   # Fix world-writable files
   chmod 644 /path/to/file
   
   # Fix directory permissions
   chmod 755 /path/to/directory
   

2. Restore File Permissions:

   • Restore from backups
   • Fix unauthorized changes
   • Update permission baseline

3. Investigate Security Issues:

   • Investigate security breaches
   • Fix compromised systems
   • Update security measures

FAQ: Common Questions About Permission Monitoring

How often should I check file permissions?

For production servers, continuous automated monitoring is essential. Zuzia.app can check file permissions every 30-60 minutes, alerting you when unusual permissions are detected.

What files should I monitor?

Monitor critical system files including /etc configuration files, system binaries, security-related files, and application configuration files. Focus on files that, if permissions change, could impact security.

How do I handle authorized permission changes?

When authorized changes are made, update the permission baseline, document the changes, and ensure monitoring systems recognize the changes as authorized. This prevents false alerts while maintaining security.

Can permission monitoring impact performance?

Permission monitoring can impact performance if not configured correctly. Use efficient monitoring tools, monitor only critical files, and schedule checks during low-traffic periods to minimize impact.

Related guides, recipes, and problems

• Related guides

  • File Integrity Monitoring - Security Audit Best Practices
  • Server Security Audit

• Related recipes

  • Long-Term File Change Monitoring and Trend Analysis on Linux

• Related problems

  • Weak SSH Configuration Security Risk