46 lines
1.5 KiB
Bash
46 lines
1.5 KiB
Bash
#!/bin/sh
|
||
# FIM substitute: SHA256 baseline (docs/Контроль_целостности; PMI p.24)
|
||
# Note: stand-in for afick, not a certification tool.
|
||
set -eu
|
||
|
||
REPORT="${REPORT:-/reports/fim.log}"
|
||
BASELINE="${BASELINE:-/tmp/fim-baseline.sha256}"
|
||
PATHS="/etc/nginx /usr/share/nginx/html /fim-watch"
|
||
WATCH_FILE="/fim-watch/config.snippet"
|
||
|
||
checksum() {
|
||
find $PATHS -type f 2>/dev/null | sort | xargs sha256sum 2>/dev/null
|
||
}
|
||
|
||
: > "$REPORT"
|
||
echo "FIM checksum audit $(date -Iseconds)" >> "$REPORT"
|
||
echo "NOTE: SHA256 baseline substitute for afick on test stand only." >> "$REPORT"
|
||
|
||
checksum > "$BASELINE"
|
||
echo "Baseline created ($(wc -l < "$BASELINE") files)" >> "$REPORT"
|
||
|
||
if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
|
||
echo "PASS baseline check (no changes)" >> "$REPORT"
|
||
else
|
||
echo "FAIL unexpected baseline diff before tamper test" >> "$REPORT"
|
||
exit 1
|
||
fi
|
||
|
||
echo "# tamper $(date +%s)" >> "$WATCH_FILE"
|
||
if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
|
||
echo "FAIL tamper not detected" >> "$REPORT"
|
||
exit 1
|
||
else
|
||
echo "PASS tamper detected after file change ($WATCH_FILE)" >> "$REPORT"
|
||
fi
|
||
|
||
printf '# FIM watch file for integrity test (PMI p.24 stand-in)\n' > "$WATCH_FILE"
|
||
if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
|
||
echo "PASS baseline restored after revert" >> "$REPORT"
|
||
else
|
||
echo "WARN baseline differs after revert (review manually)" >> "$REPORT"
|
||
fi
|
||
|
||
echo "PASS #24 integrity control (checksum substitute for afick)" >> "$REPORT"
|
||
echo "FIM checksum complete -> $REPORT"
|