[Discuss] Logging question for SOX compliance

[Dan Ritter]

On Wed, Sep 21, 2011 at 02:24:00PM -0400, scottmarydavidsam at gmail.com wrote:
> I've got a Open SUSE Linux v10.0 server which we use as a web front end to
> an inhouse billing application. Code changes to the application are
> implemented over an SSH connection.
> 
> I'm looking for a way to monitor and log who copied which files up to the
> server. Since we're not running an FTP service, there's no FTP log.
> 
> Any thoughts or suggestions?

Yes: don't do that.

Require a source code versioning system in development; branch that
for releases; have a formal build process feeding into QA and perhaps a
beta for acceptance, and have your release engineers be the only group
allowed to push to production.  Automate everything possible.
Move to a system like puppet or chef or tuttle or ... where
deployment is formalized, automated and reversible.

Oh, and document each version's changes.



-dsr-

-- 
http://tao.merseine.nu/~dsr/eula.html is hereby incorporated by reference.
You can't fight for freedom by taking away rights.