sha1sum mass checking for tampered files
I once said you can use md5sum on a bunch of files and compare the sums to a list as a sort of tripwire to check for tampered files.
You might want to do this to make sure a set of configuration files don’t get changed, or to figure out which files get changed when you build that random source code as root! (note to self: don’t make as root unless you have to, rpmbuild is bad enough!)
But here’s a better way!
To take a checksum snapshot of all the files in /etc
====# find /etc -type f -exec sha1sum {} \; > ~/sha1sum_etc====
And then to check for files that have changed since you last made that checksum list
====# sha1sum -c ~/sha1sum_etc | grep -v OK====
|
1 2 3 |
/etc/hosts: FAILED /etc/services: FAILED sha1sum: WARNING 2 of 1600 computed checksums did NOT match |
Comments Off
