InfraFenceInfraFence

Live Security Operations

Get Started

File integrity and persistence

The system files InfraFence watches with SHA-256 baselines - accounts, sudoers, SSH keys, cron, systemd units, ld.so.preload - and how changes are reported.

Last updated:

Attackers who get in try to stay in: a new SSH key, a cron job, a systemd unit, a preloaded library. The agent keeps a SHA-256 fingerprint of the files they use and reports every change.

Watched files

Files Severity of a change
/etc/sudoers, /etc/sudoers.d/* critical
/root/.ssh/authorized_keys, /home/*/.ssh/authorized_keys critical
/etc/ld.so.preload critical
/etc/shadow, /etc/ssh/sshd_config warning
/etc/crontab, /etc/cron.d/*, /var/spool/cron/crontabs/*, /var/spool/cron/* warning
/etc/systemd/system/*.service, /etc/systemd/system/*.timer warning
/etc/passwd, /etc/group, /etc/hosts, /etc/resolv.conf info

How it works

  • The agent records the fingerprint and size of each file when it starts, then compares them every 30 minutes.
  • A change is reported as an integrity_change event with the file, the old and new SHA-256 and the old and new size. The same file is not reported again for 6 hours.
  • Files larger than 10 MB are skipped.
  • The fingerprints are taken again at each start of the agent, so a change made while the agent was stopped is not reported.
  • A file that is new in a watched directory, such as a new file in /etc/cron.d, is added to the watch list and reported from its next change.

The Findings screen of the hosting panel plugins shows these changes next to the malware findings.

What the instant analysis says

The instant analysis of a change reads the file and how it changed, not only the event:

File Change Level
authorized_keys of any account bigger, or content in a file that was empty: a key was probably added High
authorized_keys same size, different content: a key may have been replaced High
authorized_keys smaller or empty: keys were removed Low
/etc/sudoers, /etc/sudoers.d/* changed / smaller High / Medium
/etc/ld.so.preload content added / emptied High / Medium
/etc/passwd, /etc/group bigger / smaller / same size Medium / Low / Medium
/etc/shadow any change Medium
/etc/ssh/sshd_config any change Medium
cron files, systemd units added or changed / smaller Medium / Low
system programs in /usr/bin, /usr/sbin, /bin, /sbin any change High
/etc/hosts, /etc/resolv.conf any change Low

An emptied file is recognized from its size or from the SHA-256 of an empty file (e3b0c442…). The analysis shows the size and the fingerprint before and after, and the commands to check the file: for SSH keys, list them, compare their fingerprints with ssh-keygen -lf and check who was logged in.

The agent compares the files every 30 minutes, so the analysis looks for SSH sessions on the same server from 40 minutes before the event to 10 minutes after it. It then says, for example, "It changed during the SSH session of root from 203.0.113.9 (Italy)", or that no SSH session was recorded around the change.

Mark as expected

When the change was you or a colleague, open the incident and choose Mark as expected, with an optional note. Owners and admins can do it; members see who marked it, when, and the note. The change no longer counts as open or critical, the event stays in the history, Reopen undoes it, and both are recorded in the activity log. A later change of the same file is open again. With agent 1.0.34 or later, the WHM plugin and infrafence-agent panel show the change as resolved too. See Events and activity for how problems are resolved.

The agent needs nothing: right after reporting a change it takes the new content as its reference, so the same change is not reported again.

Monitoring, not blocking

File integrity only reports: it never reverts a file. Combined with SSH session risk, a change made during an open SSH session raises that session's risk score.