CentOS - Jan 2015 - find out who accessed a file

Hey guys,

 Is there any way to find out the last user to access a file on a CentOS
6.5 system?

Thanks
Tim
-- 
GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

On Fri, Jan 23, 2015 at 03:50:44PM -0500, Tim Dunphy
wrote:
>  Is there any way to find out the last user to access a file on a CentOS
> 6.5 system?
Unless you're using auditd (or a similar service) to watch the file,
no.  You could probably use the logs and `last` to see who was logged
in at the time and make a guess.

-- 
Jonathan Billings <billings at negate.org>

On Fri, January 23, 2015 3:13 pm, Jonathan Billings
wrote:
> On Fri, Jan 23, 2015 at 03:50:44PM -0500, Tim Dunphy wrote:
>>  Is there any way to find out the last user to access a file on a
CentOS
>> 6.5 system?
>
> Unless you're using auditd (or a similar service) to watch the file,
> no.  You could probably use the logs and `last` to see who was logged
> in at the time and make a guess.
>
Also, you can look into shell history files (though that might be cleaned
by users). Admin is allowed to do that when investigates incident.

One more thing: if "access" constitutes execution of that file, you
can
use lastcomm (if process accounting is enabled on the system). This only
tells you the command name (not its arguments....) - so if your file is
command and you are interested who executed it and when lastcomm is your
friend.

Good luck!

Valeri

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++