Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an installation that has been tampered with, and I want to find out what exactly has been changed.

I can run

rpm -V MY_PACKAGES

which gives me a list of modified files. Now I am looking for a convenient way to see the diffs (assuming that all files have textual content) against the original rpms (which I have available).

What would be the easiest way of doing this, given that I am dealing with ~20 packages and ~200 changed files. Is there something like "rpm diff"???

share|improve this question

1 Answer 1

#
# Install yumdownloader 
#
yum install yum-utils

#
# search modified files (in this case: from pam_ldap)
#
rpm -V pam_ldap
S.5....T.  c /etc/pam_ldap.conf

#
# make tmp-dir and download rpm
#
mkdir Temp
cd Temp
yumdownloader pam_ldap

#
# extract rpm to current folder
#
rpm2cpio pam_ldap-185-11.el6.x86_64.rpm  | cpio -idmv

#
# check diff
#
diff etc/pam_ldap.conf /etc/pam_ldap.conf


rpm -V explained: 

    c %config configuration file.
    d %doc documentation file.
    g %ghost file (i.e. the file contents are not
    included in the package payload).
    l %license license file.
    r %readme readme file.

    S file Size differs
    M Mode differs (includes permissions and file type)
    5 MD5 sum differs
    D Device major/minor number mismatch
    L readLink(2) path mismatch
    U User ownership differs
    G Group ownership differs
    T mTime differs
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.