Unit 2: Reading and checking files · Lesson 5 of 6 · 18 min
Comparing with a baseline
Use diff and cmp to see exactly how a config drifted, and whether two programs are the same file.
mission
- You are
- You are measuring configuration drift on web01.
- Situation
- A hardened SSH config was approved in September and saved to /srv/baseline. Nobody knows if the live file still matches.
- Goal
- List every setting that differs and check one suspicious program against a known one.
- Hand in
- The number of drifted settings and what the hidden kthreadd program really is.
Run a plain diff
diff /etc/ssh/sshd_config /srv/baseline/sshd_config.hardened
6,7c6,7
< PermitRootLogin yes
< PasswordAuthentication yes
---
> PermitRootLogin no
> PasswordAuthentication no
11,14c11,14
< MaxAuthTries 10
< LoginGraceTime 2m
< X11Forwarding yes
< AllowTcpForwarding yes
---
> MaxAuthTries 3
> LoginGraceTime 30s
> X11Forwarding no
> AllowTcpForwarding no
you should see < lines come from the first file, > from the second. 6,7c6,7 means lines 6 to 7 changed.
diff- Shows the lines that differ between two files. Built into Linux and macOS.
Count the drift
diff /etc/ssh/sshd_config /srv/baseline/sshd_config.hardened | grep -c '^<'
6
defender tip diff -u prints the unified format used in code reviews and change tickets. Paste it straight into a finding.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
Compare two programs byte for byte
cmp stays silent when two files are identical and exits with 0. Matching hashes prove the same thing.
cmp /usr/local/lib/.cache/kthreadd /usr/bin/sleep && echo same same sha256sum /usr/local/lib/.cache/kthreadd /usr/bin/sleep 4a193eb6f25eecf27bad523cb8a53ec4d40775eb498f44760b19bfc421cc90aa /usr/local/lib/.cache/kthreadd 4a193eb6f25eecf27bad523cb8a53ec4d40775eb498f44760b19bfc421cc90aa /usr/bin/sleep
you should see A program named after a kernel thread is a renamed copy of an ordinary system tool. The processes unit finds out who runs it.
cmp- Checks whether two files are byte-for-byte identical. Built into Linux and macOS.
echo- Prints its arguments. Built into Linux and macOS.
sha256sum- Prints the SHA-256 hash of a file, a fingerprint that changes if one byte changes. Built into Linux. On a Mac, use shasum -a 256.
| Command | What it does |
|---|---|
diff a b | Show changed lines |
diff -u a b | Unified format for tickets |
cmp a b | Silent if identical |
sha256sum a b | Same hash, same content |
What a defender takes away
- 1diff shows exactly what drifted.
- 2A saved baseline turns a guess into evidence.
- 3Identical hashes mean identical files, whatever the names say.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.