Whether the monitoring file has been modified

Objective

• Related Commands :

Md5sum

• detailed command:

Linux under the shell command, the production of MD5 code is also used for software MD5 verification. The MD5 algorithm is often used to verify the integrity of network file transfers and to prevent tampering with files. MD5 Full name is the paper Digest to the algorithm (Message-digest algorithm 5), the algorithm for arbitrary length of information is calculated bitwise, resulting in a binary length of 128 bits (hex length is 32 bits) "fingerprint" (or "Digest to"), The likelihood that different files will produce the same quote digest is very, very small. In general, after installing Linux, there will be md5sum this tool, directly run directly at the command line terminal.

• How to use :

1. Use md5sum to generate a fingerprint (Message Digest) command as follows:

md5sum filename > Filename.md5

Or

md5sum filename >>FILENAME.MD5

It is also possible to export multiple files to a MD5 file, which uses a wildcard character *, such as several ISO files in a directory, to output a summary of these ISO files to the Iso.md5 file, the command is as follows:

md5sum *.iso > Iso.md5

2. Use MD5 Digest to verify the file, there are two methods:

Put the downloaded file and the file File.md5 digest file in the same directory, and then use the following command to verify:

Md5sum-c FILE.MD5

Then, if the validation succeeds, the output is: correct

Instance:

Monitor whether the/etc/passwd file has been modified.

[Email protected] libexec]# md5sum/etc/passwd >/ETC/CHBO.MD5

[Email protected] libexec]# md5sum-c/ETC/CHBO.MD5

/etc/passwd:ok

[email protected] libexec]# cat CHECK_PASSWD

#!/bin/sh

Char= ' md5sum-c/etc/chbo.md5 2>/dev/null|grep "OK" |wc-l '

If [$char-eq 1];then

echo "passwd is OK"

Exit 0

Else

echo "passwd is changed"

Exit 2

Fi

IDEA Development:

1. This can be placed under the/usr/local/nagios/libexec/under the Remote_linux.

2. The/usr/local/nagios/etc/nrpe.cfg under the Remote_linux

   [Email protected] etc]# tail-1 nrpe.cfg
   

   command[check_passwd]=/usr/local/nagios/libexec/check_passwd

3. Nrpe Deamom under Remote_linux can then be called under Nagios_server through the plug-in Check_nrpe to detect if the/etc/passwd file has been modified.
   

Whether the monitoring file has been modified