Natively you can set up auditd to watch for changes to various system
parameters like date/time, hostname, or /etc/passwd changes.  

If you need something with more robust reporting and rules options,
Tripwire's pretty slick and has both FOSS and enterprisey versions.
http://www.tripwire.org/

- Jill


O
n 2013-12-24 01:55, Derek Trotter wrote:

> stuff on her husband's computer in an attempt to frame him.  
> Investigators checked out the computer and found the pictures were put 
> on the computer at a time when her husband wasn't at home.
> 
> With linux is there a log that  is usually kept or that could be enabled 
> that would log any changes in the system's date or time? Is there a way 
> to tell if someone had gone into the bios, changed the date and then 
> changed it back?  I have to wonder if this woman would have gotten away 
> with it if she had changed the date before putting the pictures on the 
> computer, then changing it back.
> 
> http://www.foxnews.com/us/2013/12/23/pennsylvania-woman-tried-to-frame-hubby-with-child-porn/?intcmp=latestnews
> 
> -- 
> "I get my copy of the daily paper, look at the obituaries page, and if I’m not there, I carry on as usual."
> 
> Patrick Moore
> 
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss