Detect Configuration File Changes on Linux: diff, AIDE
Detect Configuration File Changes on Linux: diff, AIDE
Need to check configuration file changes on your Linux server? Want to monitor config file modifications, detect unauthorized changes, and track configuration history? This guide shows you how to check configuration file changes using built-in commands and automated monitoring with Zuzia.app.
For comprehensive configuration monitoring strategies, see Configuration Drift Monitoring. For troubleshooting configuration issues, see Configuration Drift Causing Issues.
Why Checking Configuration Changes Matters
Configuration files control system and application behavior. When configuration files change unexpectedly, services can malfunction, security settings can be altered, and system behavior can change. Checking configuration file changes helps you detect unauthorized modifications, track configuration history, maintain configuration integrity, and ensure configurations remain correct.
Method 1: Check File Modification Times
Check file modification times to detect when files were changed:
View File Modification Times
# Check file modification time
stat /etc/ssh/sshd_config
# View modification time for config files
find /etc -type f -mtime -1 -ls
# Check for recently modified files
find /etc -type f -newer /tmp/reference-time -ls
# View configuration file history
ls -lt /etc/ssh/ | head -10
Detect Recent Changes
# Find recently modified config files
find /etc -type f -mtime -1
# Check for files modified today
find /etc -type f -newermt "$(date +%Y-%m-%d)" -ls
# View modification times
stat /etc/ssh/sshd_config /etc/nginx/nginx.conf | grep Modify
Method 2: Compare Configuration Files
Compare configuration files with previous versions to detect changes:
Compare with Previous Versions
# Compare current config with previous
diff /etc/ssh/sshd_config /backup/sshd_config.baseline
# Compare multiple config files
diff -r /etc/nginx/ /backup/nginx-baseline/
# Check for configuration differences
diff /etc/ssh/sshd_config /backup/sshd_config.baseline | head -20
# Compare with last known good state
diff /etc/ssh/sshd_config /backup/sshd_config-$(date +%Y%m%d).txt
Detect Configuration Changes
# Check if config matches expected configuration
diff /etc/ssh/sshd_config /policies/ssh-policy.conf
# Verify configuration consistency
md5sum /etc/ssh/sshd_config /backup/sshd_config.baseline
# Check for unexpected modifications
find /etc -type f -newer /tmp/last-check -exec diff {} /backup/{}.baseline \;
Method 3: Monitor Configuration File Integrity
Monitor configuration file integrity to detect unauthorized changes:
Check File Checksums
# View file checksums
md5sum /etc/ssh/sshd_config
# Compare checksums
md5sum /etc/ssh/sshd_config /backup/sshd_config.baseline
# Verify configuration file integrity
md5sum -c /backup/config-checksums.txt
# Track checksum changes
md5sum /etc/ssh/sshd_config > /tmp/checksum-current.txt
diff /tmp/checksum-baseline.txt /tmp/checksum-current.txt
Use AIDE for File Integrity
# Check for configuration changes
sudo aide --check
# Update AIDE database after authorized changes
sudo aide --update
# Verify file integrity
sudo aide --check | grep -i "changed\|added\|removed"
Method 4: Automated Configuration Change Monitoring with Zuzia.app
Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.
How it works in Zuzia
- Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
- Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
- If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
- The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.
Setting it up
- Add the server in the Zuzia dashboard and install the agent.
- Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
- Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.
Custom Configuration Monitoring Commands
Add these commands as scheduled tasks:
# Check for configuration changes
find /etc -type f -mtime -1
# Compare critical configurations
diff /etc/ssh/sshd_config /backup/sshd_config.baseline
# Verify configuration checksums
md5sum /etc/ssh/sshd_config /etc/sudoers
# Monitor system configuration
sysctl -a | diff - /backup/sysctl-baseline.txt
Best Practices
1. Monitor Configurations Regularly
Use Zuzia.app for continuous configuration monitoring. Set up alerts before configuration issues become critical. Review configuration changes regularly.
2. Maintain Configuration Baselines
Keep accurate configuration baselines. Store baselines in version control. Update baselines when authorized changes occur.
3. Track All Configuration Changes
Monitor all configuration modifications. Track authorized changes. Detect unauthorized changes. Document change procedures.
Troubleshooting
Unauthorized Changes Detected
When unauthorized changes are detected:
- Review current configuration:
cat /etc/ssh/sshd_config - Compare with baseline:
diff /backup/sshd_config.baseline /etc/ssh/sshd_config - Restore from backup if needed:
cp /backup/sshd_config.baseline /etc/ssh/sshd_config
Configuration File Modified
When configuration files are modified:
- Check modification time:
stat /etc/ssh/sshd_config | grep Modify - Review changes:
diff /backup/sshd_config.baseline /etc/ssh/sshd_config - Verify changes are authorized
- Restore if unauthorized
FAQ
How often should I check configuration file changes?
For production servers, check configuration changes every 6-12 hours. Zuzia.app can check configurations automatically and alert when changes are detected.
What configuration files should I monitor?
Monitor all production configuration files, especially security configurations (SSH, firewall, sudo), service configurations, and application configurations.
Can Zuzia.app detect unauthorized configuration changes?
Yes, Zuzia.app can detect unauthorized changes by comparing current configurations with baselines, monitoring file modifications, tracking configuration checksums, and alerting when changes are detected.
Related guides, recipes, and problems
Related guides
Related recipes
Related problems