I don't know the answer, but that's a great idea.

If one doesn't already exist, I wonder if it's possible to accomplish a similar thing using already available tools: Create a cron job that lists all the files and folders in your site. I'm not much familiar with Linux/Unix, but I think the command is "ls" or some variant, maybe with switches? Then have the results emailed to you. Use Windows/DOS fc.exe to compare each day's listing against the previous.

The specific use I was thinking of wouldn't really require daily runs. When someone posts here after they've been hacked, one of the standard bits of advice is to "go through your entire site looking for files you didn't put there". That is an incredible pain, even using FTP, and besides, there are numerous files that were not put there by the site owner but are nonetheless ok and necessary.

So I was thinking why not do a file listing at a point where you know you haven't been hacked. Then you have a clean listing for comparison after a hack.

building on SteveW's idea... I wonder if it would be possible to have the results of the directory listing (path, filename, and last modified date mainly) placed into a database. If it is a new file then it is added as a new record. If a file disappears it is marked as "deleted". Otherwise just the modification date is updated. Then after a hack you could sort the files based on the last modified date and see both what new files had been added as well as which files had been modified and when. For something like this, you'd probably need to be careful about what directory listings you were getting and how often since it could take some processing depending on the number of files and subdirectories... you could even use the opendir(), readdir(), etc. commands in PHP to handle this without having to use cron, passthru(), etc. to run something at the command-line level... now if I find the time I might play with this idea a bit...

You wouldn't be able to install Tripwire on our shared servers as that will require a compile and install on the server. The best thing to do on a shared server would be to do some sort of ls, have it record the files (or do an md5 hash of the list of files). If the list changes at all it won't match the md5 hash in the database or where every you stored it at and then you would know the file structure has changed.

You can create a PHP script that would generate a list of files and directories for each directory or a list of specified directories to get a hash from and to compare to at a later time (that way you know specifically where the files may have changed instead of having to go through each directory).

Let us know if you have any other questions.

I don't have Linux booted right now, but IIRC, the switch is -R to recursively list directories. Don't confuse it with -r, which reverses the listing order. There's no such word as "recurse" (where's the emoticon for "grind teeth"?).


I think bash, Perl, and PHP scripts will all consider / to be the system root, so you probably want to start at /home/<your account>/.


I think the cron command could be as simple as ls -alR. Let it email the whole output to you. On your PC, compare it against an older, "good" listing.


If you can pull the listing itself out of the email into a file on your PC, you could try to find a "smart-compare" utility like the Linux diff to highlight differences between the new and old files. Don't bother with the DOS comp command -- it's worse than useless. That reminds me, I need to take a stroll over to Sourceforge or FSF to see if they have anything like diff that works on Windoze.

More advanced work would be to do a checksum on each file, to see if someone has altered a file without changing its size or timestamp. LP might have the md5 (?) command installed. I don't know if automating any of this would be worth the effort, as files do change, appear, and disappear during normal operations. Maybe you could write something to just flag new files and changes to certain existing files (e.g., .html or .php, but not maiboxes). You could also have all this work on on the server side (do an ls and/or md5 on the files, compare it to the previous, and email back any suspicious changes).

here's the code I've been working on for myself related to this... it is a PHP script that generates a listing of files, sorted by modification time. This means the more recent files will be towards the top of the list. I've set it up with some configurable options at the start for no real reason...

At a minimum you will need to set the value of $cPanel_UserName to your account. If you do not limit it to public_html, then you will get a lot of "unexpected" files (mailboxes, various cpanel files, log files, etc) which are modified each day. You can limit the number of days back it goes, though really it is basing it on 24 hour periods, so if you run it at noon set to go 1 day back, it only goes back to noon on the previous day not midnight. Still, this could be useful to find files added/changed on your site in the past xx days. The "formatted" output isn't exactly pretty, but it's functional. The comma delimited version is best viewed as source and creates a file you could import into Excel or another program if you wanted to.

also, I do not consider myself a programmer, so I'm sure the code could probably be improved by someone who knows what they are doing Use at your own risk...


Again, didn't say the code was pretty, but it gets the job done and might serve as a starting point for your own project... my eventual goal with this is to have the info inserted into a DB and the script can check against the DB to determine which files have been modified. Once I identify files/directories that change frequently (like the mail inbox) I will eliminate those from being checked. Then the script can be set to run via cron once a day or so and email a list of files that have changed since the prior day... of course, getting the script to that point is going to take me some time since this is really low on my list of to-dos at this point... just my thought on how to go about doing this without having to execute commands via cron or compare files to each other for changes.... in the short run though I can check files against a list I've already generated and look back for files modified in the past week or so if I ever need to try and track something down...

It is now late (my time) so ignore the parts of this post that make absolutely no sense

 
To set up a cron job, go to cpanel > Cron Jobs > Standard. Enter the email address to use and the command line to run. For the other fields, I made selections in all of them, corresponding to "right now", i.e. Tuesday, February 6, 7PM, with the Minutes field set safely to several minutes in the future. Then click "Save Crontab". After this one-time cron job has run, be sure to go back into Cron Jobs > Standard and delete it.

As an experiment, I set up a cron job with the command:
pwd
which shows the current directory. This showed that I was in my home (root) directory (/home/myusername), and that therefore I could run the ls command with no path specified, as the default one would be correct.

To get a complete listing of all the files in your site, you can use this command line with exactly this capitalization:

Some other options are listed at http://www.ss64.com/bash/ls.html and http://en.wikipedia.org/wiki/Ls.

The resulting email can be big. My listing was about 1MB with 13,000 files listed. The fine-toothed-comb comparison method is thus impractical. Haven't considered yet how to compare the two files. Probably with FC.EXE to start with, and MSAccess might provide some useful methods such as with a Find Unmatched query.

I opted to use the default sort order for the ls command, and NOT sort by last-modified timestamp, because if you're going to compare TWO of these listings, you want the files listed in the exact same order.

Now that I have the file listing I need, I don't plan to run this cron job at any specified interval such as to discover a hack. I figure the fact that a hack has taken place will be obvious enough that one doesn't need to hunt for it. This listing is only for identifying suspicious files to examine after you know a hack has occurred.

Here are some sample output lines:


The first character is the file type, "-" for file, "d" for directory, "l" for link. The remaining 9 characters are the permissions levels.
I don't know what the 2nd column is.
The 3rd and 4th columns must have to do with who created the file or who owns it or who last modified it? The next column is the file size, then the month and day. The next column will be a misery for a database import: it's the last-modified timestamp unless it's old, in which case it's the year! The last column is the file name, followed by a "/" if it's a directory rather than a file.