Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

md5sum questions

9 views
Skip to first unread message

Steve F

unread,
Apr 30, 2013, 5:05:22 AM4/30/13
to
Morning all,

Complete md5sum newbie here, and don't have a lot of experience with shell scripting either.

I've got a requirement to check a few binaries on a nightly basis for modifications (essentially we think one of our servers on a testing environment has some code injection problems, but without trawling through every line of code to track it, md5sum can just tell us IF the code has changed).

I understand how md5sum can tell us this information
What I want is a bit of bash script that I can cron to run nightly
I have a script now that can check to see if the md5 changes (md5sum -c /path/to/file.md5) but it's capturing that output and notifying me if the status is abnormal.

i'm hoping this is just a case of my coffee not kicking in yet but I'm stuck.

Bit Twister

unread,
Apr 30, 2013, 6:12:40 AM4/30/13
to
On Tue, 30 Apr 2013 02:05:22 -0700 (PDT), Steve F wrote:
> Morning all,

Same to you.

You might want to set your Usenet client G2/webform to line wrap
around 70 characters. That allows reply depth indicators to not cause
line wrap most of the time. It also is good Usenet etiquette.

Some subject matter experts may not bother to reply if they have to
reformat your text to fit the Usenet guidelines.


> Complete md5sum newbie here, and don't have a lot of experience with
shell scripting either.

Well, these might help. Ignore the ! and keyword string
http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html ! basic shell bash doc
http://cfaj.freeshell.org/shell ! bash script tips usage doc
http://tldp.org/LDP/abs/html/index.html ! bash advanced documentation
http://mywiki.wooledge.org/BashFAQ/050 ! bash variable expansion document


>
> I've got a requirement to check a few binaries on a nightly basis
> for modifications (essentially we think one of our servers on a
> testing environment has some code injection problems, but without
> trawling through every line of code to track it, md5sum can just
> tell us IF the code has changed).

I would have thought the "find" utility and modification argument
would find all those for you.


> I understand how md5sum can tell us this information
> What I want is a bit of bash script that I can cron to run nightly

Sounds pretty easy so far.

> I have a script now that can check to see if the md5 changes
> (md5sum -c /path/to/file.md5) but it's capturing that output and
> notifying me the status is abnormal.

Well that seems to be just what you asked for. Throw it in the nightly
cron directory and you should be good to go.

> i'm hoping this is just a case of my coffee not kicking in yet but I'm stuck.

With out seeing your code, and exactly what you want, it is pretty hard
to tell you what you need.

Steve F

unread,
Apr 30, 2013, 6:33:28 AM4/30/13
to
On Tuesday, 30 April 2013 11:12:40 UTC+1, Bit Twister wrote:
> On Tue, 30 Apr 2013 02:05:22 -0700 (PDT), Steve F wrote:
>
> > Morning all,
>
>
>
> Same to you.
>
>
>
> You might want to set your Usenet client G2/webform to line wrap
>
> around 70 characters. That allows reply depth indicators to not cause
>
> line wrap most of the time. It also is good Usenet etiquette.
>
>
>
> Some subject matter experts may not bother to reply if they have to
>
> reformat your text to fit the Usenet guidelines.
>
Apologies, I didn't even consider that, but thanks for informing me.
>
>
>
>
> > Complete md5sum newbie here, and don't have a lot of experience with
>
> shell scripting either.
>
>
>
> Well, these might help. Ignore the ! and keyword string
>
> http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html ! basic shell bash doc
>
> http://cfaj.freeshell.org/shell ! bash script tips usage doc
>
> http://tldp.org/LDP/abs/html/index.html ! bash advanced documentation
>
> http://mywiki.wooledge.org/BashFAQ/050 ! bash variable expansion document
>
I'll definitely have a read of those, thank you.
>
>
>
> >
>
> > I've got a requirement to check a few binaries on a nightly basis
>
> > for modifications (essentially we think one of our servers on a
>
> > testing environment has some code injection problems, but without
>
> > trawling through every line of code to track it, md5sum can just
>
> > tell us IF the code has changed).
>
>
>
> I would have thought the "find" utility and modification argument
>
> would find all those for you.
>
>
>
>
>
> > I understand how md5sum can tell us this information
>
> > What I want is a bit of bash script that I can cron to run nightly
>
>
>
> Sounds pretty easy so far.
>
>
>
> > I have a script now that can check to see if the md5 changes
>
> > (md5sum -c /path/to/file.md5) but it's capturing that output and
>
> > notifying me the status is abnormal.
>
>
>
> Well that seems to be just what you asked for. Throw it in the nightly
>
> cron directory and you should be good to go.
>
>
>
> > i'm hoping this is just a case of my coffee not kicking in yet but I'm stuck.
>
>
>
> With out seeing your code, and exactly what you want, it is pretty hard
>
> to tell you what you need.

At the moment the script literally just runs an md5sum -c against the original
sum but as it's a cron that runs at night I'm not seeing the output anywhere
sensible, so I end up running the same command when I get up in the morning.
All I really want is the cron to run, and notify me (email, console, wherever)
if the status is anything other than "OK"

Bit Twister

unread,
Apr 30, 2013, 7:00:02 AM4/30/13
to
On Tue, 30 Apr 2013 03:33:28 -0700 (PDT), Steve F wrote:
> On Tuesday, 30 April 2013 11:12:40 UTC+1, Bit Twister wrote:

>> You might want to set your Usenet client G2/webform to line wrap
>>
>> around 70 characters. That allows reply depth indicators to not cause
>>
>> line wrap most of the time. It also is good Usenet etiquette.
>>
>>
>>
>> Some subject matter experts may not bother to reply if they have to
>>
>> reformat your text to fit the Usenet guidelines.
>>
> Apologies, I didn't even consider that, but thanks for informing me.

If you can not stop that extra line between each line of replies, you
need to get a different Usenet client.

>
> At the moment the script literally just runs an md5sum -c against the original
> sum but as it's a cron that runs at night I'm not seeing the output anywhere
> sensible, so I end up running the same command when I get up in the morning.
> All I really want is the cron to run, and notify me (email, console, wherever)
> if the status is anything other than "OK"

That is easy, if you check the md5sum man page. Hint --status :-D
Man page found with the command man md5sum

How do you check status you ask?

if [ $? -ne 0 ] ; then
mail -s "Whatever you like here" root < /dev/null
fi

SwissCheese

unread,
Apr 30, 2013, 7:51:12 AM4/30/13
to
Take a look here to get you started:

http://en.wikipedia.org/wiki/Md5sum

But something like this will get you started:

---code---
md5sum -c /path/to/file.md5 > md5results.txt
mail -s "MD5 File check results." f...@example.invalid < md5results.txt
--- end of code---

...just change the email address to reflect where you want it to go.

--
Norman
Registered Linux user #461062
AMD64X2 6400+ Ubuntu 10.04 64bit

Richard Kettlewell

unread,
Apr 30, 2013, 8:11:46 AM4/30/13
to
Steve F <steve...@gmail.com> writes:
> Morning all,
>
> Complete md5sum newbie here, and don't have a lot of experience with
> shell scripting either.

MD5 is broken. The details may or may not matter for your particular
threat model but it is a bad choice for any new application.

I suggest using one of the SHA-2 family (say, SHA256) instead; coreutils
has supported these functions for some years now.

--
http://www.greenend.org.uk/rjk/

Auric__

unread,
Apr 30, 2013, 8:36:44 AM4/30/13
to
Bit Twister wrote:

> On Tue, 30 Apr 2013 03:33:28 -0700 (PDT), Steve F wrote:
>> On Tuesday, 30 April 2013 11:12:40 UTC+1, Bit Twister wrote:
>
>>> You might want to set your Usenet client G2/webform to line wrap
>>> around 70 characters. That allows reply depth indicators to not cause
>>> line wrap most of the time. It also is good Usenet etiquette.
>>>
>>> Some subject matter experts may not bother to reply if they have to
>>> reformat your text to fit the Usenet guidelines.
>>>
>> Apologies, I didn't even consider that, but thanks for informing me.
>
> If you can not stop that extra line between each line of replies, you
> need to get a different Usenet client.

Steve is using Google Gropes. Google has apparently decided that they don't
need to follow anything as nitpicky as standards and guidelines.

"RFCs?! We don't NEED no stinkin' RFCs!"

--
- It makes you what we in the psychiatry field refer to as "fucked up".
- Well, I guess that's fair.

Bit Twister

unread,
Apr 30, 2013, 8:45:14 AM4/30/13
to
On Tue, 30 Apr 2013 12:36:44 +0000 (UTC), Auric__ wrote:
> Bit Twister wrote:

> Steve is using Google Gropes. Google has apparently decided that they don't
> need to follow anything as nitpicky as standards and guidelines.

In that case, Steve really needs to get a free Usenet account and a
pick a Usenet client. I'll recommend http://www.eternal-september.org/
for the account and add a score rule to flag any of his posts to see
if he wants to make such a small effort to allow us to help him in the
future.

Jasen Betts

unread,
Apr 30, 2013, 6:36:32 AM4/30/13
to
On 2013-04-30, Steve F <steve...@gmail.com> wrote:
> Morning all,
>
> Complete md5sum newbie here, and don't have a lot of experience with shell scripting either.
>
> I've got a requirement to check a few binaries on a nightly basis for modifications (essentially we think one of our servers on a testing environment has some code injection problems, but without trawling through every line of code to track it, md5sum can just tell us IF the code has changed).
>
> I understand how md5sum can tell us this information
> What I want is a bit of bash script that I can cron to run nightly
> I have a script now that can check to see if the md5 changes (md5sum -c /path/to/file.md5) but it's capturing that output and notifying me if the status is abnormal.

basically for cron jobs you want to organise them so they normally
produce no output, any output they do produce you'll get emailed.

--
⚂⚃ 100% natural

--- news://freenews.netfront.net/ - complaints: ne...@netfront.net ---

Martijn Lievaart

unread,
May 1, 2013, 1:49:55 AM5/1/13
to
Not answering your question, but did you have a look at aide? http://
aide.sourceforge.net/. It is probably available in your distros
repositories.

M4

unruh

unread,
May 1, 2013, 11:11:52 AM5/1/13
to
On 2013-05-01, Martijn Lievaart <m...@rtij.nl.invlalid> wrote:
> On Tue, 30 Apr 2013 02:05:22 -0700, Steve F wrote:
>
>> Morning all,
>>
>> Complete md5sum newbie here, and don't have a lot of experience with
>> shell scripting either.
>>
>> I've got a requirement to check a few binaries on a nightly basis for
>> modifications (essentially we think one of our servers on a testing
>> environment has some code injection problems, but without trawling
>> through every line of code to track it, md5sum can just tell us IF the
>> code has changed).

Yes.

>>
>> I understand how md5sum can tell us this information What I want is a
>> bit of bash script that I can cron to run nightly I have a script now
man md5sum

md5sum filename >/tmp/c

Then run the following

if ! OUT=`md5sum -c /tmp/c`; then
mail -s `echo "$OUT" campe...@wally.com<<EOF
md5sum failed
.
EOF
0 new messages