Unit 12: Auditing and hardening · Lesson 6 of 7 · 20 min

File integrity baselines

A list of hashes taken on a known-good day shows every file that changed or appeared since.

mission

You are
You are checking web01's system files against September's baseline.
Situation
On 30 September the previous admin hashed the accounts, cron, profile, systemd and /usr/local/bin files into /srv/baseline/system-2026-09-30.sha256.
Goal
List what changed and what is new since then.
Hand in
Changed files and new files, each with an explanation or a finding.
01

Read the baseline

learner@root-lab
head -n 3 /srv/baseline/system-2026-09-30.sha256
662e10da2a027aaa7d1571e6e03cc26e318c8d8d38ed936598c8b01a6d2186cd  /etc/passwd
17aeca7fc301bcdd7660f9a6d8e66cd9d5dc4ddf44993b6ff9cf12aa0500186a  /etc/group
3cecec7a18962d06636922b866677e8b935cb3d4c49b7ece11469c66420b0da7  /etc/ssh/sshd_config
grep -c . /srv/baseline/system-2026-09-30.sha256
13

you should see Thirteen files, one hash each.

02

What changed

--quiet prints only failures.

learner@root-lab
sha256sum -c --quiet /srv/baseline/system-2026-09-30.sha256
/etc/passwd: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

you should see /etc/passwd changed: the sysops account.

03

What is new

Hashes cannot flag files that were not there. Compare the lists of names too.

learner@root-lab
awk '{print $2}' /srv/baseline/system-2026-09-30.sha256 | sort > /tmp/then.txt
find /etc/cron.d /etc/profile.d /etc/systemd/system /usr/local/bin -maxdepth 1 -type f | sort > /tmp/now.txt
comm -13 /tmp/then.txt /tmp/now.txt
/etc/cron.d/.sync-check
/etc/profile.d/proxy.sh
/etc/systemd/system/kthreadd-helper.service

you should see All three persistence files from the 13 October session.

defender tip AIDE and similar tools automate this daily. Keep the baseline off the server, or an attacker can update it.

Baselines

On the server only
/srv/baseline/system.sha256
writable by root

Whoever gets root rewrites history

Off the box and signed
baseline in the config repo
signed, compared daily by CI

Changes show up whoever made them

What a defender takes away

  1. 1Hash known-good state, then compare on a schedule.
  2. 2Compare file lists, not only hashes.
  3. 3Store baselines where the server cannot change them.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.