用freebsd-update查看被改动过的系统文件
系统用的久了，很多系统自带的文件就会被改动，这包括配置文件。怎么样查看到底哪些文件被改动过呢？
或者是另一个场景：怎么样找出被黑客或病毒修改过的系统文件呢？
其实FreeBSD自带的freebsd-update工具就可以完成这个任务，大致原理是：
在每个freebsd的发行版中，都存有一份hash文件，叫INDEX文件，这个文件记录每一个系统文件的hash值，在使用freebsd-update验证的时候，先到官方网站上去下载相应版本的INDEX文件，然后再逐个文件进行hash验证。
来看一下实际的例子：
root@test:/root # freebsd-update IDS
Looking up update.FreeBSD.org mirrors... 5 mirrors found.
Fetching metadata signature for 10.0-RELEASE from update5.freebsd.org... done.
Fetching metadata index... done.
Fetching 2 metadata patches.. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
/boot/kernel/aac.ko has SHA256 hash 806af98ecd5df74b4da7c880918dbf4e655f3705921511c31dee8cb6111067d2, but should have SHA256 hash ba4e6a5420c8b4faae588c829facf7fe2f939c5a47a967f93a1c44b5ec263db9.
/boot/kernel/aacraid.ko has SHA256 hash fb705fbb6d08d4092d4c2bc7cfbede15a456677559a6a10910b5f03201fc9f22, but should have SHA256 hash 922bb44da8c359d1b751d7857eee7890487e8d9412dffafaadd71c5f0e266ac3.
……
/boot/kernel/zfs.ko has SHA256 hash 52b32c78ed511706afdbfcf10301b36172f747966ea3a5ced2e61f246ce10537, but should have SHA256 hash 8417c2444df4aa495c9ee7e953b9e24ff91a552b512ad7041ced4724f6482e63.
/boot/kernel/zlib.ko has SHA256 hash bef00038a7c97a7421c8e018f45c73bb4716aacd64848b3b5bcd5f2be15e0411, but should have SHA256 hash 79ecfc87812bc6eb29ef77dbe7eb44ba6c3a0e26bbc27a13c113ed24c6fe6366.
/etc/group has SHA256 hash a4e4584d52cb1f6c38da60665e0499329eb0c2ddf60007adb342b5ded0c63bd3, but should have SHA256 hash 1f68e64b4876b37e09bc79ed225f1e9a9108b76ba38737d3226097b9fe8d2498.
/etc/master.passwd has SHA256 hash 11d4bec037f4a0c3cbe229aa62d18a88bcf3ffe6839e6587b87a7c5804125c11, but should have SHA256 hash de62a130dfb98bade5a66248c14edc9a0a8ce6e93e702b36caf9b63f6a840649.
/etc/motd has SHA256 hash 554a1f41a4c4c132aad1c01d1e84ca70b0d36fa74fb19e4992a496359090c3a8, but should have SHA256 hash 1ff792835b8bb81675e44fbc1a63dc09b8757f624d0cc3b9d1f3bee9313e303a.
/etc/passwd has SHA256 hash 82707a5696b34fa3ac1b671a5a2cec2e765f308c9c6a6e6414ee8965d5380089, but should have SHA256 hash 4e3ff0d61033c37d5e36cd056c98fb5ba966116c884d1e69434bb537f1ea23be.
/etc/pkg/FreeBSD.conf has SHA256 hash 76aaa3b0d57a76f4406642dbd322fd739bb39667895041e219771f6e0058b452, but should have SHA256 hash ce5aa1534051178ee414489b1ca1061b686176d2b4678e3cdae8d3ff6bd4d1c5.
/etc/pwd.db has SHA256 hash 3a881a972000e34fa1bbcd14278f35314cac66afb5cfcb611612e2bf0aebcfd8, but should have SHA256 hash 1b481658b7b6aa8126fef82f745a37e3b6e896d247364eb797e2cb434f370354.
/etc/spwd.db has SHA256 hash dda773bea92b2d0c6a7d3fa15e4c4fb2cf3c3fa9ef75174ede48f5efb6826432, but should have SHA256 hash 5f4a19eafc5edd3a903a32c835cb3f71181f3e89c9bf2fbbf7ecc14fae69cf5b.
/etc/ssh/sshd_config has SHA256 hash 3b9f5dabb16898d0fb8cfed61436fa7abd34bb437d86e3733a31e60f9ad96b2a, but should have SHA256 hash acceda7ad5143f107c19277afaba9791bbde8573b1565a30fe4bcfb14068dd7c.
/etc/sysctl.conf has SHA256 hash 6306387743f3872762e9bf624526191ce27b602249257c929cb5c82a485e12c2, but should have SHA256 hash 85243c9828f638959eacc74ceb687e5fb446b33cb790156343fdc5ff579ee703.
root@test:/root #
结果比较直观，稍微说明几点：
（１）这当中用了一行省略号，是因为我自已编译过内核文件，所以整个kernel目录下的文件都会显示被改动过。
（２）变动过的配置文件也显示出来了，但是rc.conf除外，因为rc.conf正常情况下是必须变动的。
（３）passwd，master.passwd、group以及pwd.db的变动是因为用户名和密码变动而产生的，一般不需要紧张。
（４）如结果所示，hash值用的是sha256，验证效果要比md5好一些。
（５）如果不希望freebsd-update对比一些文件，比如kernel目录下的文件，可以写入到/etc/freebsd-update.conf中，每个文件或文件夹用一行，可以有很多行，文件和文件夹都可以，比如：
IDSIgnorePaths /boot/kernel
IDSIgnorePaths /etc/sysctl.conf
当前位置：
论坛首页 »
自由讨论区 »
VMware, Unix及操作系统讨论区
»
发起投票
技术讨论
加好友
发消息
2015-2-25 22:16:10 |
赞(
操作
