See history of who all opened a particular file

You can use auditd package as suggested in another answer. A simple use would be: auditctl -w /etc/passwd -p war -k password-file which will watch for write, append, read operations on this file. You can then retrieve the audit logs through the comm…