General :: How To Monitor Changed File

How do I monitor which files have been changed after, say, I run the passwd command? (I know, depending on the options used, it changes /etc/shadow and/or /etc/passwd). But I would like to if there is any clever ways of monitoring this. This is how I do it which is a bit crude, and I have to know which directory to monitor. Before running the command, I run

Code:

for i in $(ls -A) do; md5sum $i >> /tmp/before; done

And after running the command, I run

Code:

for i in $(ls -A) do; md5sum $i >> /tmp/after; done

Then I do a diff to see if any file has been changed

Code:

diff /tmp/{before,after}