The audit program recursively searches through directories looking for files that may not be needed or have strange permissions, ownership, etc. It is intended to help people clean up their accounts and find hidden problems with files.

The program looks for problems in seven general areas: file permissions, file names, file sizes, file types, file ownership, directories and links, and file timestamps. It recursively searches starting from the directories named on the command line. If no directory is specified, it starts from the home directory of the user specified by the --user option (or the current user if no --user option is given). Any files with unusual attributes cause a warning to be displayed.

Specific checks can be disabled either using command line options, or by using the .auditrc file. Specific warning messages can also be suppressed by listing them in the .auditrc file.

Audit should work on any Linux system, and on other Unix-compatible systems, possibly with some porting. Audit is still in early beta release. I welcome any bug reports or suggestions from beta testers.

Sample Output

audit: `/home/guest/insecurefile': Warning 1005: group writable
audit: `/home/guest/emptydir': Warning 6002: empty directory
audit: `/home/guest/old': Warning 7005: modify time in past
audit: `/home/guest/link': Warning 4005: symbolic link
audit: `/home/guest/secret': Warning 1008: not world readable
audit: `/home/guest/mydir': Warning 1020: directory without search permission for world
audit: `/home/guest/empty': Warning 3001: zero length file
audit: `/home/guest/small': Warning 3003: small file
audit: `/home/guest/funny name': Warning 2005: filename contains whitespace characters
audit: `/home/guest/always_look_on_the_bright_side_of_life.crd': Warning 2002: long filename
audit: `/home/guest/badlink': Warning 6003: dangling symbolic link

Recent News

08 Feb 1999: Version 0.2 has a couple of minor changes needed to compile under Solaris.