RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. B

RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. But then updating the index becomes problematic, you would need to create delta files (which themselves are also immutable) that contain the changed information and combine the data. Even then, I'm not convinced you could get that much valuable information from a full filesystem hash (or whatever) scan. The amount of information would probably be overwhelming. You would need to apply heuristics or filters. Checking filetypes with libmagic would work, mostly. You could only alert on new executables or whatever, etc..