2

I have a consultant that was hired to install some custom software to a CentOS 5 server. After she's done, I'd like to review her changes to possibly automate or optimize them.

I was thinking of:

  1. Somehow, snapshot the system before handing it over to her.
  2. After she's done, compare the snapshot to review file changes, permission changes, etc..

I'm already having her shell automatically run script to keep a log of her console. However, this won't capture all file changes (e.g., if she uses the edit command in vim to modify a file).

2
  • 1
    failing all else, recordmydesktop.
    – Sirex
    Feb 25, 2015 at 1:17
  • Taking a snapshot is easy. Analyzing the changes will be your difficulty.
    – fpmurphy
    Feb 28, 2015 at 16:58

1 Answer 1

3
  1. If you simply want to answer the question, "what files on this system have changed", then use a tool that generates checksums for all your files. Run it before the consultant makes any changes, run it afterwards, and look for files that have changed. Store the results someone other than on the system. And of course, be aware that some files change regularly as part of the normal running of things.

    Tools that perform this task are often called "file integrity checkers". Solutions include tripwire, afick, aide, and others. This article by the author of Samhain is a reasonably good overview of various file integrity checkers. I haven't used any of these recently.

  2. If you actually want to see content before and after, one option is to back everything up first, and then later on compare the state of the system to your backups. You could use something as simple as tar or rsync to make your backup, and later on you can compare the backups with the current state of the system. You could use whatever tool you select for (1) to identify files that have changed, and then compare the backups and the current file.

  3. If you're not concerned about malicious changes and you have an LVM-based configuration, you could skip the backup step in (2) by creating a snapshot your filesystems. The reason this doesn't protect against malicious changes is, of course, that the snapshots share the same storage as the original files and someone with malicious intent can simply update the snapshots, but it does provide a solution with relatively few resource requirements.

1
  • Update: aide is packaged for CentOS 5 and seems reasonably easy to install and configure.
    – larsks
    Feb 25, 2015 at 3:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .