<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.4.4">
</HEAD>
<BODY>
Natively you can set up auditd to watch for changes to various system parameters like date/time, hostname, or /etc/passwd changes. <BR>
<BR>
If you need something with more robust reporting and rules options, Tripwire's pretty slick and has both FOSS and enterprisey versions. <A HREF="http://www.tripwire.org/">http://www.tripwire.org/</A><BR>
<BR>
- Jill
<PRE>
O
n 2013-12-24 01:55, Derek Trotter wrote:
> stuff on her husband's computer in an attempt to frame him.
> Investigators checked out the computer and found the pictures were put
> on the computer at a time when her husband wasn't at home.
>
> With linux is there a log that is usually kept or that could be enabled
> that would log any changes in the system's date or time? Is there a way
> to tell if someone had gone into the bios, changed the date and then
> changed it back? I have to wonder if this woman would have gotten away
> with it if she had changed the date before putting the pictures on the
> computer, then changing it back.
>
> http://www.foxnews.com/us/2013/12/23/pennsylvania-woman-tried-to-frame-hubby-with-child-porn/?intcmp=latestnews
>
> --
> "I get my copy of the daily paper, look at the obituaries page, and if I’m not there, I carry on as usual."
>
> Patrick Moore
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
</PRE>
</BODY>
</HTML>