Auditd Configuration: Monitoring Linux System File Changes

The Linux Auditing System (`auditd`) logs detailed security events, tracking modifications to critical system files like `/etc/passwd` or `/etc/shadow` in real-time.

1. Defining Audit Rules

Add file monitoring rules inside `/etc/audit/rules.d/audit.rules`:

-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes

Key options: -p wa monitors write (w) and attribute changes (a); -k adds a custom search key label.

2. Reviewing Audit Logs

Query audit logs using `ausearch`:

ausearch -k passwd_changes -i