auditctl -w passwd

sudo auditctl -w /etc/passwd -p wa -k passwd_changes

Adds an auditd rule that monitors writes and attribute changes to /etc/passwd with a custom search key.

Run it on Linux servers when you want to know instantly if someone touches the account files: the rule logs to the audit log any write (w) or attribute change (a) on /etc/passwd (and by extension /etc/shadow, /etc/sudoers, /etc/group). The -k passwd_changes key lets you retrieve events with ausearch without remembering paths. It's the basis of integrity monitoring on Linux without installing agents: auditd comes with any distro, and the rule is permanent if you put it in /etc/audit/rules.d/.

Don't use it as your only defense: the rule watches the file, but an attacker with root can stop auditd or delete the logs before touching it (auditctl -D, systemctl stop auditd). On hosts without an active audit policy, the rule is added but there's no base log — verify with auditctl -l that it's loaded. And watch out for noise: on systems where /etc/passwd is modified by management tools (puppet, ansible, AD joins), every legitimate change generates events; the -k key is what lets you filter without pain. In ephemeral containers it makes no sense: the file doesn't survive.