[Discuss] Logging question for SOX compliance

[gaf at blu.org (Jerry Feldman)]

On 09/21/2011 03:17 PM, Dan Ritter wrote:
> On Wed, Sep 21, 2011 at 02:24:00PM -0400, scottmarydavidsam at gmail.com wrote:
>> I've got a Open SUSE Linux v10.0 server which we use as a web front end to
>> an inhouse billing application. Code changes to the application are
>> implemented over an SSH connection.
>>
>> I'm looking for a way to monitor and log who copied which files up to the
>> server. Since we're not running an FTP service, there's no FTP log.
>>
>> Any thoughts or suggestions?
> Yes: don't do that.
>
> Require a source code versioning system in development; branch that
> for releases; have a formal build process feeding into QA and perhaps a
> beta for acceptance, and have your release engineers be the only group
> allowed to push to production.  Automate everything possible.
> Move to a system like puppet or chef or tuttle or ... where
> deployment is formalized, automated and reversible.
>
> Oh, and document each version's changes.
>
One possible solution is to use Alfesco http://www.alfresco.com/ which
is essentially a Sharepoint alternative for Linux. I have not looked at
details, but with Sharepoint you can enforce document versioning, and I
assume that Alfresco also supports that. And certainly any code changes
should use a source code control mechanism, such as git, SVN, or CVS.
All of these work well.

-- 
Jerry Feldman <gaf at blu.org>
Boston Linux and Unix
PGP key id:3BC1EB90 
PGP Key fingerprint: 49E2 C52A FC5A A31F 8D66  C0AF 7CEA 30FC 3BC1 EB90