Linux Security Cookbook

1.17. Integrity Checking Manually

Problem

You can’t use Tripwire for administrative or political reasons, but you want to snapshot your files for later comparison. You don’t have enough disk space to mirror your files.

Solution

Run a script like the following that stores pertinent information about each file of interest, such as checksum, inode number, and timestamp:

#!/bin/sh
for file
do
    date=`/usr/bin/stat "$file" | /bin/grep '^Modify:' | /usr/bin/cut -f2- -d' '`
    sum=`/usr/bin/md5sum "$file" | /usr/bin/awk '{print $1}'`
    inode=`/bin/ls -id "$file" | /usr/bin/awk '{print $1}'`
    /bin/echo -e "$file\t$inode\t$sum\t$date"
done

Store this script as /usr/local/bin/idfile (for example). Use find to run this script on your important files, creating a snapshot. Store it on read-only media. Periodically create a new snapshot and compare the two with diff .

This is not a production-quality integrity checker. It doesn’t track file ownership or permissions. It checks only ordinary files, not directories, device special files, or symbolic links. Its tools (md5sum, stat, etc.) are not protected against tampering.

Discussion

1. Run the idfile script to create a snapshot file:

   # find /dir -xdev -type f -print0 | \ 
     xargs -0 -r /usr/local/bin/idfile > /tmp/my_snapshot

   This creates a snapshot file, basically a poor man’s Tripwire database.

   /bin/arch 2222 7ba4330c353be9dd527e7eb46d27f923 Wed Aug 30 17:54:25 2000 /bin/ash 2194 cef0493419ea32a7e26eceff8e5dfa90 Wed Aug 30 17:40:11 2000 /bin/awk 2171 b5915e362f1a33b7ede6d7965a4611e4 ...