Calculates the MD5 value in the directory, which is used to compare files after being tampered with

Calculates the MD5 value in the/etc directory for the file to be tampered with, following the command:

find/etc/-maxdepth 1-type F | Xargs-n1 md5sum>/root/etc_sum-$ (date +%f). log

The same truth,

We can/usr/bin/usr/sbin//usr/local/bin/root/bin and so on the important directory of the file checksum is calculated once, so that the regular execution of the command, generate a new checksum, Compare the generated log file with the original md5sum.log by using the diff command.

If there is a change, the server may be compromised, need to promptly check the poison (check the poison, you can use ClamAV this software, Epel source has this RPM package)

Here is the script I wrote about whether the test file has changed, Sir, as a sample of the original MD5 checksum, as follows:

Find/bin-maxdepth 1-type F | Xargs-n1 md5sum >/home/sum/bin_sum_ori.log find/sbin-maxdepth 1-type F | Xargs-n1 md5sum >/home/sum/sbin_sum_ori.log

Then, write the/home/scripts/chkmd5sum.sh script, the following script I only/sbin and/bin under the file md5sum do the check, the other can be referenced to add:

#!/bin/bashbin_sum_log= "/home/sum/bin_sum-$ (date +%f). LOG" sbin_sum_log= "/home/sum/sbin_sum-$ (date +% F). Log "find /bin -maxdepth 1 -type f | xargs -n1 md5sum >   $BIN _sum_logfind /sbin -maxdepth 1 -type f | xargs -n1  md5sum >  $SBIN _sum_logif ! diff  $BIN _sum_log  /home/sum/bin_sum_ori.log  > /dev/null ;thenecho  "Some file ' s md5sum is changed in  /bin,please check "|mail -s " warning, /bin checksum not matched " [email  protected]fiif ! diff  $SBIN _sum_log  /home/sum/sbin_sum_ori.log >  /dev/null ;thenecho  "Some file ' s md5sum is changed in /sbin,please  check "|mail -s " warning, /sbin checksum not matched " [email  Protected]fi

Then we add a Cron scheduled task (below), 0 points a day 30 check the execution of the script, detect whether the file changes.

Echo ' 0 * * */bin/bash/home/scripts/chkmd5sum.sh >/dev/null 2>&1 ' >>/var/spool/cron/root

Of course, there is a Linux under the software called Tripwire, it is more powerful, interested in Baidu can be their own under.

Calculates the MD5 value in the directory, which is used to compare files after being tampered with