init

results/scripts/run-fim-checksum.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+# FIM substitute: SHA256 baseline (docs/Контроль_целостности; PMI p.24)
+# Note: stand-in for afick, not a certification tool.
+set -eu
+
+REPORT="${REPORT:-/reports/fim.log}"
+BASELINE="${BASELINE:-/tmp/fim-baseline.sha256}"
+PATHS="/etc/nginx /usr/share/nginx/html /fim-watch"
+WATCH_FILE="/fim-watch/config.snippet"
+
+checksum() {
+  find $PATHS -type f 2>/dev/null | sort | xargs sha256sum 2>/dev/null
+}
+
+: > "$REPORT"
+echo "FIM checksum audit $(date -Iseconds)" >> "$REPORT"
+echo "NOTE: SHA256 baseline substitute for afick on test stand only." >> "$REPORT"
+
+checksum > "$BASELINE"
+echo "Baseline created ($(wc -l < "$BASELINE") files)" >> "$REPORT"
+
+if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
+  echo "PASS  baseline check (no changes)" >> "$REPORT"
+else
+  echo "FAIL  unexpected baseline diff before tamper test" >> "$REPORT"
+  exit 1
+fi
+
+echo "# tamper $(date +%s)" >> "$WATCH_FILE"
+if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
+  echo "FAIL  tamper not detected" >> "$REPORT"
+  exit 1
+else
+  echo "PASS  tamper detected after file change ($WATCH_FILE)" >> "$REPORT"
+fi
+
+printf '# FIM watch file for integrity test (PMI p.24 stand-in)\n' > "$WATCH_FILE"
+if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
+  echo "PASS  baseline restored after revert" >> "$REPORT"
+else
+  echo "WARN  baseline differs after revert (review manually)" >> "$REPORT"
+fi
+
+echo "PASS  #24 integrity control (checksum substitute for afick)" >> "$REPORT"
+echo "FIM checksum complete -> $REPORT"