I have an installation that has been tampered with, and I want to find out what exactly has been changed.

I can run


which gives me a list of modified files. Now I am looking for a convenient way to see the diffs (assuming that all files have textual content) against the original rpms (which I have available).

What would be the easiest way of doing this, given that I am dealing with ~20 packages and ~200 changed files. Is there something like "rpm diff"???

# Install yumdownloader 
yum install yum-utils

# search modified files (in this case: from pam_ldap)
rpm -V pam_ldap
S.5....T.  c /etc/pam_ldap.conf

# make tmp-dir and download rpm
mkdir Temp
cd Temp
yumdownloader pam_ldap

# extract rpm to current folder
rpm2cpio pam_ldap-185-11.el6.x86_64.rpm  | cpio -idmv

# check diff
diff etc/pam_ldap.conf /etc/pam_ldap.conf

rpm -V explained: 

    c %config configuration file.
    d %doc documentation file.
    g %ghost file (i.e. the file contents are not
    included in the package payload).
    l %license license file.
    r %readme readme file.

    S file Size differs
    M Mode differs (includes permissions and file type)
    5 MD5 sum differs
    D Device major/minor number mismatch
    L readLink(2) path mismatch
    U User ownership differs
    G Group ownership differs
    T mTime differs
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.