FileIntegra

Supported Platforms

Installation

# Install the binary
chmod +x fileintegra-linux-amd64
sudo mv fileintegra-linux-amd64 /usr/local/bin/fileintegra

# Set up config directory
sudo mkdir -p /etc/fileintegra
sudo cp config.example.yaml /etc/fileintegra/config.yaml
sudo chmod 600 /etc/fileintegra/config.yaml

# Edit config with your SMTP credentials and monitored files
sudo nano /etc/fileintegra/config.yaml

Configuration

Important: Create a dedicated email account specifically for FileIntegra (e.g., fileintegra@yourdomain.com). Do not use a shared or personal email account. If the SMTP password is changed on the mail server and not updated in config.yaml, FileIntegra will fail to send alerts silently. A dedicated account ensures no one accidentally changes the password during routine credential rotations.

Config Reference

email:
  smtp_host: "smtp.example.com"
  smtp_port: 587            # 587 = STARTTLS, 465 = implicit TLS
  username: "alerts@example.com"
  password: "your-password"
  from: "alerts@example.com"
  to:
    - "admin@example.com"
  subject_prefix: "[File Integrity Alert]"

storage:
  snapshot_file: "/var/lib/fileintegra/snapshots.json"

monitored_files:
  - "/etc/passwd"
  - "/etc/shadow"
  - "/etc/ssh/sshd_config"

Usage Examples

# Check specific files
fileintegra --config config.yaml /etc/passwd /etc/ssh/sshd_config

# Check all files from config
fileintegra --config config.yaml --all

# Dry run (no emails sent, no snapshots updated)
fileintegra --config config.yaml --dry-run --all

# Take fresh snapshots (no alerts sent)
fileintegra --config config.yaml --reset --all

# Test email configuration
fileintegra --config config.yaml --test

# Quiet mode + summary (ideal for cron)
fileintegra --config config.yaml --all --quiet --summary

# Notify when new files are added to monitoring
fileintegra --config config.yaml --all --notify-new

# Check version
fileintegra --version

Command Flags

Exit Codes

Cron Setup

By default, FileIntegra only sends an email when a file change is detected. No change = no email. The --quiet flag prevents cron from generating its own notification emails.

# Check every 5 minutes, email only on changes
*/5 * * * * /usr/local/bin/fileintegra --config /etc/fileintegra/config.yaml --all --quiet

# Hourly check with summary report (sends email every run regardless of changes)
0 * * * * /usr/local/bin/fileintegra --config /etc/fileintegra/config.yaml --all --quiet --summary

Security Notes

• Store config.yaml with restricted permissions (chmod 600)
• The snapshot file should also be protected (chmod 600)
• Consider running as a dedicated service user
• For production, use environment variables or a secrets manager for SMTP credentials

Permissions & Sudoers

Some monitored files (e.g., /etc/shadow) require root access to read. If running FileIntegra from cron as a non-root user, add a sudoers entry:

# /etc/sudoers.d/fileintegra
youruser ALL=(root) NOPASSWD: /usr/local/bin/fileintegra

Then run from cron with sudo:

*/5 * * * * sudo /usr/local/bin/fileintegra --config /etc/fileintegra/config.yaml --all --quiet

Alternatively, run the cron job directly as root via sudo crontab -e.

Frequently Asked Questions

I made a legitimate change to a monitored file. How do I stop getting alerts?

Run fileintegra --config config.yaml --reset --all to take fresh snapshots. The next check will use the new baseline.

I changed my email password and now FileIntegra isn't sending alerts. What do I do?

Update the password field in your config.yaml to match the new password, then run fileintegra --config config.yaml --test to verify it works.

How do I know if FileIntegra is actually running?

Check your cron logs (grep fileintegra /var/log/syslog) or run it manually without --quiet to see output.

Can I monitor files that require root access (e.g., /etc/shadow)?

Yes. Either run FileIntegra as root, or add a sudoers entry: youruser ALL=(root) NOPASSWD: /usr/local/bin/fileintegra. Then use sudo /usr/local/bin/fileintegra in your cron job.

What happens if a monitored file is deleted?

FileIntegra will report an error for that file. It won't send a change alert — it will show the file as missing in the summary.

Can I monitor an entire directory?

Not directly. List each file individually in monitored_files in your config. This is by design — monitoring specific critical files is more secure than watching entire directories.

How often should I run FileIntegra?

Every 5 minutes is a good default for critical servers. For less sensitive systems, hourly or daily may be sufficient.

Will FileIntegra slow down my server?

No. It only reads files and computes a fingerprint. The overhead is negligible, even when checking dozens of files every few minutes.

How do I set up FileIntegra to run automatically?

Add a cron job. Open your crontab with crontab -e (or sudo crontab -e for root) and add:
*/5 * * * * /usr/local/bin/fileintegra --config /etc/fileintegra/config.yaml --all --quiet

What does --dry-run do exactly?

It checks all files and shows you what changed, but does not save the new snapshots and does not send any emails. Useful for testing your setup before going live.

What do the exit codes mean?

Exit 0 = all files are unchanged. Exit 1 = an error occurred (bad config, can't read a file, email failed). Exit 2 = one or more files were modified (integrity change detected).

What permissions does the config file need?

Set it to chmod 600 so only the owner can read it — it contains your SMTP password. The snapshot file should also be chmod 600.

How do I add more files to monitor?

Edit your config.yaml and add file paths under monitored_files. Then run fileintegra --config config.yaml --reset --all to take initial snapshots of the new files.

What does --notify-new do?

By default, when FileIntegra sees a file for the first time, it takes a snapshot silently. With --notify-new, it sends an email confirming which new files have been added to monitoring.

Can I send alerts to multiple people?

Yes. Add multiple email addresses under the to field in your config.

What's the difference between --quiet and --summary?

--quiet suppresses all console output (ideal for cron so you don't get cron emails). --summary sends a summary email after each check regardless of whether changes were found. You can use both together.