#!/usr/bin/perl -w use strict; use warnings; use Mail::Sendmail; @ARGV == 1 or die "usage: $0 watchfile"; my $watchfile = $ARGV[0]; print "watching $watchfile.\n"; my $pid = fork(); unless ( $pid ) { my $access_time = (stat($watchfile))[8]; my $modify_time = (stat($watchfile))[9]; while( sleep 5 ) { unless( $access_time == (stat($watchfile))[8] ) { print "ACCESS CHANGED!!\n"; tripwire( $watchfile, "accessed" ); $access_time = (stat($watchfile))[8]; } unless( $modify_time == (stat($watchfile))[9] ) { print "MODIFY CHANGED!!\n"; tripwire( $watchfile, "modified" ); $modify_time = (stat($watchfile))[9]; } } } sub tripwire { my $file = shift || "unknown"; my $what = shift || "unknown"; my %mail = ( To => 'pariss@efn.org', From => 'Aighearach@makeyourbanner.com', Subject => 'SECURITY VIOLATION!!!', Message => "SECURITY VIOLATION!!! $file $what\n".`who` ); sendmail(%mail); `wall 'what the hell are you doing\? --AUTOMATED (report generated)'`; }