Linux Tips

Linux File Access Auditing: Track Who Accessed /etc/shadow

- by John Britto - Leave a Comment - 2 min read
Quick Linux Tip #96:

Question: Who accessed /etc/shadow and when, over the last week?

Try: sudo aureport --file --start week-ago | grep shadow

Info: aureport summarizes audit log reports by file access. Using ausearch -i translates UIDs and syscalls into human-readable text, while auid tracks the original login user even across sudo sessions.

Examples:

  • $ sudo aureport --user --summary  # Summary of user activity
  • $ sudo ausearch -ua linuxteck --start today  # Search audit events for specific user
  • $ sudo aureport --failed  # Review all failed security events

Note: Requires auditd active with file watch rules enabled (auditctl -w). The audit user ID (auid) remains invariant during sudo, ensuring precise accountability for compliance frameworks (SOC 2, PCI).




LinuxTeck.com 
linuxteck:~$ sudo aureport --file --start week-ago | grep shadow

File Report
================================
# date time file syscall success exe auid event
================================
123. 10/01/2026 09:23:45 /etc/shadow openat yes /usr/bin/vim 1000 4523
124. 10/02/2026 14:34:56 /etc/shadow openat yes /usr/sbin/passwd 0 4567
125. 10/03/2026 11:12:34 /etc/shadow openat no /usr/bin/cat 1001 4612
126. 10/05/2026 08:45:23 /etc/shadow openat yes /usr/bin/vim 1000 4678

linuxteck:~$ sudo ausearch -f /etc/shadow -i --start week-ago | head -30
type=PROCTITLE msg=audit(10/05/2026 08:45:23.234:4678): proctitle=vim /etc/shadow
type=PATH msg=audit(10/05/2026 08:45:23.234:4678): item=0 name=/etc/shadow nametype=NORMAL
type=SYSCALL msg=audit(10/05/2026 08:45:23.234:4678): arch=x86_64 syscall=openat success=yes exit=3 comm=vim exe=/usr/bin/vim auid=linuxteck uid=root
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #95: Linux Package Comparison: Find Differences Between 2 Servers NEXT ARTICLE Quick Linux Tip #97: Linux Shared Library Dependencies: Fix Missing Libraries
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.