I've 2 small scripts running on a daily basis to check not only if files have been changed but also if they have been uploaded by a valid user or not. Maybe you can use/modify them for your own needs?
Ok, I know this can be done a little more efficient, but I was in hurry when doing it and never looked at it again... sorry
The first makes an md5 checksum of every .html, .js and .php in the /home/ directory and below. Compiles a list of valid ftp users and a list of ftp access from the logfiles.
The second checks the changes files against the ftp users file and prints a message if a file isn't uploaded by the correct user.
For me (on that specific server) this is sufficient, but it does fire when someone runs a webbased install somewhere as these files are not uploaded by ftp. Actually it is intended to fire then
If you want to check all files on your server, simple change the 'find' in the first script to something like:
find / | xargs md5sum > md5.dat.today
but, this will yield a lot of changes.
Put it in the cron and you're done.
Code:
#!/bin/bash
#run this first
cd /var/test
mv md5.dat.today md5.dat.yesterday
find /home -iname "*.htm*"|grep -v '/stats/'|grep -v '/awstats/'| sed 's/ /\\ /g' | xargs md5sum > md5.dat.today
find /home -iname "*.php*"|grep -v '/stats/'|grep -v '/awstats/'| sed 's/ /\\ /g' | xargs md5sum >> md5.dat.today
find /home -iname "*.js"|grep -v '/stats/'|grep -v '/awstats/'| sed 's/ /\\ /g' | xargs md5sum >> md5.dat.today
diff md5.dat.today md5.dat.yesterday|grep "<" > changed_today.dat
cat /etc/proftpd.passwd | gawk -F ":" '{print $1, $6}' > ftpusers.dat
cat /var/log/proftpd/access.log /var/log/proftpd/access.log.1 |grep 'STOR '|grep -v '\.tmp' | awk '{print $3, $7}'| cut -d '"' -f1 > uploaded_files.dat
cat /var/log/proftpd/access.log /var/log/proftpd/access.log.1 |grep 'RNTO '|grep -v '\.tmp' | awk '{print $3, $7}'| cut -d '"' -f1 >> uploaded_files.dat
Code:
#!/bin/sh
#run this when the first has completed (or just put them together in one script).
cd /var/test
while read dummy md5 filename
do
USER=`echo $filename | gawk -F "/" '{print $2 "/" $3}'`
ISVALID="no"
while read usr homedir
do
if [[ "$filename" == ${homedir}* ]]
then
BASEFILE=`basename ${filename}`
# find user and file in uploaded files
FOUND=`cat uploaded_files.dat | grep "${usr} ${BASEFILE}"`
if [ "${FOUND}" == "" ]
then
DUM='yes'
else
ISVALID="yes"
fi
fi
done < "ftpusers.dat"
if [ "${ISVALID}" == "yes" ]
then
DUM='yes'
# echo "### VALID UPLOAD: ${usr} uploaded file: $filename"
else
echo "### WARNING!!! FILE: ${filename} has not been uploaded by a valid user using FTP"
fi
done < "changed_today.dat"
