Updated: 28 September 2026 · Applies to: Linux audit 3.1 and 4.0 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10; auditd on Ubuntu 24.04 and 26.04 and Debian 13
Changes to /etc/passwd, /etc/shadow and /etc/group mean that user accounts, passwords or group memberships changed. An unexpected change is a strong sign of an intrusion, so security standards require auditing these files. The rules below are the "identity" rules from the sample file 30-stig.rules that ships with the audit package.
1. Install auditd
dnf install audit # AlmaLinux, Rocky Linux, RHEL (usually installed) apt install auditd # Ubuntu, Debian
2. Add the rules
Create /etc/audit/rules.d/30-identity.rules:
-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=identity
perm=wa records writes and attribute changes. /etc/security/opasswd holds old password hashes used to prevent password reuse. The sample file repeats each line with arch=b32 to cover 32-bit programs; add those lines too if your policy requires it. A shorter form that watches the same files is -w /etc/shadow -p wa -k identity.
3. Load and check
augenrules --load auditctl -l | grep identity
4. See who changed what
ausearch -k identity -i ausearch -k identity -i --start today aureport -f -i --start this-week | grep -E 'passwd|shadow|group'
Each event shows the program (for example useradd, passwd or usermod), the user who originally logged in (auid) and the time. An unexpected program, such as an editor or a script, deserves a closer look.
Test it
useradd audittest && userdel audittest ausearch -k identity -i --start recent | tail -20
Related guides: how to find out who deleted a file and how to monitor system time changes with auditd.
Official documentation: audit.rules manual page and Auditing the system (Red Hat).
