History of users modifying a file in Linux

It is possible to configure auditing to track changes to specific files. There are some limitations:

• it has to be configured before the changes of interest
• the auditing daemon tends to refuse to start if told to watch a file which has been deleted.

Still, it can be useful. Look for auditctl. Here are some useful links discussing the topic:

• Linux audit files to see who made changes to a file
• Monitoring Linux File access, Changes and Data Modifications
• Track file changes using auditd
• The Linux Audit System, or Who Changed That File?

I am aware that stat or ls -lrt will give the last user who modified the file.

No. Modifying a file does not change its owner.

In general filesystems do not keep track of modification histories. If this information is crucial, the way to go is

1. For complete file hierarchies: a VCS (Version Control System) like Git, Subversion, Mercurial, CVS, ...
2. For single files, RCS or SCCS, ...

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

1. use stat command (ex: stat , See this)
2. Find the Modify time
3. Use last command to see the log in history (see this)
4. Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.