4 ms·

Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read c

• eriknstr 10y ago
  Some years ago, I had Tripwire installed for a few days but quickly removed it again because whenever I upgraded installed packages, I'd get a storm of messages about files which had changed and that was just annoying since I was the one who had initiated the action that caused the files to change, but at the same time there were so many files that changed of course, that I had no way of distinguishing legitimate changes (as they all were) from any potential illegitimate changes.
  • bigiain 10y ago
    That's precisely what it's supposed to do. If you update the Tripwire db every time you "initiate an action that causes monitored files to change" - then it does a _magnificent_ job of telling you when someone _else_ changes those files. You need to run 'tripwire --update' every time you run 'apt-get update' or 'pip install foo' or 'npm install bah' or whatever - then you wont get that storm of false positives.
    • mcbain 10y ago
      Honest question from an interested party: have you actually had it alert you about someone else changing the files? I've been in the previous boat: of having it running on a system I've inherited, and given up because it seemed too much hassle.
      • bigiain 10y ago
        Yes - a few times a year when normal and authorised things or people have unexpectedly changed files in tripwire-protected places, and in ~20 years I think three times when I'd had an intrusion. Those three timely notifications of real breaches have made 20+ years worth of occasional false positives 100% worth it.
• locusm 10y ago
  iowatch is a nice simple alternative.
• ars 10y ago
  On debian you can also use debsums which has the advantage that the checksums come from the distribution directly.