Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an installation that has been tampered with, and I want to find out what exactly has been changed.

I can run


which gives me a list of modified files. Now I am looking for a convenient way to see the diffs (assuming that all files have textual content) against the original rpms (which I have available).

What would be the easiest way of doing this, given that I am dealing with ~20 packages and ~200 changed files. Is there something like "rpm diff"???

share|improve this question
# Install yumdownloader 
yum install yum-utils

# search modified files (in this case: from pam_ldap)
rpm -V pam_ldap
S.5....T.  c /etc/pam_ldap.conf

# make tmp-dir and download rpm
mkdir Temp
cd Temp
yumdownloader pam_ldap

# extract rpm to current folder
rpm2cpio pam_ldap-185-11.el6.x86_64.rpm  | cpio -idmv

# check diff
diff etc/pam_ldap.conf /etc/pam_ldap.conf

rpm -V explained: 

    c %config configuration file.
    d %doc documentation file.
    g %ghost file (i.e. the file contents are not
    included in the package payload).
    l %license license file.
    r %readme readme file.

    S file Size differs
    M Mode differs (includes permissions and file type)
    5 MD5 sum differs
    D Device major/minor number mismatch
    L readLink(2) path mismatch
    U User ownership differs
    G Group ownership differs
    T mTime differs
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.