/ 
Monitoring-Sneck-Checks-0.0.2
/ Monitoring::Sneck::Checks::checksums

NAME

Monitoring::Sneck::Checks::checksums - checks files against stored checksums

VERSION

Version 0.0.1

SYNOPSIS

!setuid_sums||perl:checksums -l /usr/local/etc/sneck/setuid.sha256
!sshd_sum||perl:checksums -F /usr/sbin/sshd=5ea6737a5debfd2195a09cb910d8c0e8d6fa3dda458b6de2ac400a17febd276a

To make a list, on Linux or FreeBSD.

sha256sum /usr/bin/sudo /usr/bin/passwd > /usr/local/etc/sneck/setuid.sha256
sha256 /usr/local/bin/sudo /usr/bin/passwd > /usr/local/etc/sneck/setuid.sha256

DESCRIPTION

Hashes each file and compares it against what is stored for it, through Digest::MD5 and Digest::SHA. A file that differs, is not there, or can not be read is CRITICAL. A list that can not be read, a line in one that is not understood, or nothing to check, is UNKNOWN.

Lists may be in the format of sha256sum and the like, "hash path", or that of FreeBSD's sha256 and the like, and sha256sum --tag, "SHA256 (path) = hash". Blank lines and those starting with # are skipped. md5, sha1, sha224, sha256, sha384, and sha512 are known by the length of the hash.

Anyone who can change the files can most likely change the list too, so keep it somewhere they can not, and check it with Monitoring::Sneck::Checks::file_mode.

OPTIONS

- -l, --list :: A checksum list. May be given more than once.

- -F, --file :: "path=hash", a file and its hash. May be given more than once.

One of --list or --file must be given.

METHODS

check

Does the check.

hash_file

Returns the hex digest of a file. Dies if it can not be read.

- path :: The file.

- algorithm :: md5, sha1, sha224, sha256, sha384, or sha512.

my $hash = $check->hash_file( '/usr/sbin/sshd', 'sha256' );