Ravi Sir's Cards › AWS
Who changed /etc/passwd?
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
What it is
auditd watches files.
Why it matters
Add a watch rule with a key.
How / example
Search.
sudo ausearch -k passwd-watch