News for hackers. Stuff that matters.

A comment on How often should I rotate my SSH keys?. Parent comment

Re:How often should I rotate my SSH keys? by dotancohen on Friday February 26, 2021 @12:05PM (#26277008) 

  > check for processes accessing the file
How? I could check at any point in time if the file is being accessed now, but how could I ensure that it hasn't been accessed in the past? The ext4 access time can be forged by the same process that accesses the file. Should I have a daemon running to check this? If so, then why isn't this already a feature in common Linux distros?
[ Parent | on HN ]
Re:How often should I rotate my SSH keys? by jlgaddis on Friday February 26, 2021 @01:23PM (#26277986)
> If so, then why isn't this already a feature in common Linux distros?

It is. It's called auditd, is quite possibly already installed (albeit probably not configured to do much), and can easily ship its logs off to another host (natively or via syslogd).

[ Parent | on HN ]
Re:How often should I rotate my SSH keys? by dotancohen on Friday February 26, 2021 @01:55PM (#26278354)
Thank you. I'm checking out auditd now.
[ Parent | on HN ]