RE: How to Set Watches for NFS Automounts?
From the client perspective (I should have said). Certainly auditing
the mount works and you could set up something to "catch" this audit
event occurring and then set a watch point, but I'm hoping that there's
a more straightforward way to accomplish this.
-----Original Message-----
From: Michael Folsom [mailto:mwfolsom@gmail.com]
Sent: Tuesday, July 10, 2007 2:35 PM
To: Taylor, Tad
Cc: linux-audit(a)redhat.com
Subject: Re: How to Set Watches for NFS Automounts?
Tad:
Hmmmmmmmmmmm...
From which perspective? The client or the server?
For the client how about putting a watch on the mount command?
I added:
-a entry,always -S mount
to the end of /etc/audit.rules file and it works fine.
Now re: the server I'm curious how to handle this myself. Perhaps the
same thing may work there too.........
M-
On 7/10/07, Taylor_Tad(a)emc.com <Taylor_Tad(a)emc.com> wrote:
I'm trying to figure out a way to set file system watches for NFS
file
systems that are automounted (i.e., they get mounted automatically
when
someone accesses them).
When an NFS file system is already mounted, it's straightforward to
set a
watch on the path, however, for automounted file systems, you
can't
set a
watch when the file system isn't mounted. Any suggestions as to
the
best
way to go about doing this?
Thanks,
--Tad Taylor
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit