Execute command on file access

[bornav]

Does there currently exist a way to set up that when a folder/file is accessed that truenas executes a shell command(honeypot of sorts)
My goal would be that when a folder is accessed that wasn't supposed to to run the "midclt call pool.dataset.lock <pool>" to lock the dataset

 

[sretalla]

I can't see a version of that which wouldn't be the same as "just lock the pool/dataset to start with".

Are you saying you want to monitor the access from the network (like over SMB?) and then based on the username or something, decide (not sure how you think you'll be detecting a stolen password or impersonation or whatever else) that particular activity wasn't OK, then lock the dataset?

Maybe you could do something like that using the full_audit settings on SMB and have something monitoring the access logs there and react as you want (IMO would take a lot of logic to have something that isn't just going to lock the dataset on every access).

Good luck with that.