tripwire

#!/bin/sh

#############################################################################################
# Automation to check for new/changed files                                                 #
# Author: Aimee Camaclang                                                                   #
#                                                                                           #
# Created: March 2010                                                                       #
#                                                                                           #
# Builds a database of pathnames and checksums in an attempt to discover changes to a       #
# system. It does this by comparing results of a new run against the results of a previous  #
# run. Files that appear in the new run but not the previous are flagged as new files;      #
# files that appear in the previous run but not the new are flagged as deleted files.       #
# Changed files are found using an md5sum check. All database and report files generated    #
# by this script is chmod 600 for security.                                                 #
#                                                                                           #
# Use option --init when running this script on a path for the first time. It will simply   #
# get and save the current state of files in the specified path.                            #
# Use option --scan to compare results of the current run against the results of the        #
# previous run.                                                                             #
#############################################################################################

source /etc/a5.conf

#############################################################################################
# deal with command line arguments

if [ "$1" != "--init" ] && [ "$1" != "--scan" ]; then
  echo "Usage: `basename $0` [option]"
  echo "Scan for new/changed files in path."
  echo ""
  echo "Options"
  echo -e "--init\tinitialize database only"
  echo -e "--scan\tscan for new/changed files"
  echo "  Otherwise, this awesome help file."
  echo ""
  echo "Config file in /etc/a5.conf"
  echo "Database files are savedstate.txt and savedstatemd5.txt"
  echo ""
  exit 1
fi

#############################################################################################
# get current state

# find command to walk through directory structure, write pathnames to file
echo ""
echo "Calculating pathnames database..."
for dir in $dsearch
do
  if [ -d $dir ]; then
    find $dir -type f >> $logdir/savedstate.txt
  else
    echo "Error: '$dir' does not exist!!"
    echo "Skipping."
  fi
done
chmod 600 $logdir/savedstate.txt

# find command to walk through directory structure, write checksums/pathname to file
echo ""
echo "Calculating md5 database..."
for dir in $dsearch
do
  if [ -d $dir ]; then
    find $dir -type f -print0 | xargs -0 md5sum >> $logdir/savedstatemd5.txt
  else
    echo "Error: '$dir' does not exist!!"
    echo "Skipping."
  fi
done
chmod 600 $logdir/savedstatemd5.txt

#############################################################################################
# if scanning for changes
if [ "$1" = "--scan" ];then

  ######################################
  # parse results

  echo ""
  echo "Parsing results..."

  touch $logdir/newfiles.txt
  chmod 600 $logdir/newfiles.txt
  touch $logdir/deletedfiles.txt
  chmod 600 $logdir/deletedfiles.txt

  sort $logdir/savedstate.txt.bak > $logdir/savedstate-sort.txt.bak
  sort $logdir/savedstate.txt > $logdir/savedstate-sort.txt

  # show pathnames that only exist in current state
  comm -13 $logdir/savedstate-sort.txt.bak $logdir/savedstate-sort.txt > $logdir/newfiles.txt

  # show pathnames that only exist in previous state
  comm -23 $logdir/savedstate-sort.txt.bak $logdir/savedstate-sort.txt > $logdir/deletedfiles.txt

  rm -f $logdir/savedstate-sort.txt
  rm -f $logdir/savedstate-sort.txt.bak

  #######################################
  # md5sum check files in savedstatemd5.txt.bak

  md5sum -c $logdir/savedstatemd5.txt.bak 2>&1 | grep -v 'OK$' &> $logdir/md5changes.txt

  chmod 600 $logdir/md5changes.txt

  #######################################
  # display results

  echo ""
  echo "Results:"

  if [ `cat $logdir/newfiles.txt|wc -l` -eq 0 ]
  then
    echo "No new files were detected. Cleaning up."
    rm -f $logdir/newfiles.txt
  else
    echo "New files were detected. View $logdir/newfiles.txt for details."
  fi

  if [ `cat $logdir/deletedfiles.txt|wc -l` -eq 0 ]
  then
    echo "No deleted files were detected. Cleaning up."
    rm -f $logdir/deletedfiles.txt
  else
    echo "Deleted files were detected. View $logdir/deletedfiles.txt for details."
  fi

  if [ `cat $logdir/md5changes.txt|wc -l` -eq 0 ]
  then
    echo "No file changes were detected. Cleaning up."
    rm -f $logdir/md5changes.txt
  else
    echo "File changes were detected. View $logdir/md5changes.txt for details."
  fi

fi

#############################################################################################
# save current state

echo ""
echo "Saving current state."

mv $logdir/savedstate.txt $logdir/savedstate.txt.bak
mv $logdir/savedstatemd5.txt $logdir/savedstatemd5.txt.bak