I actually made a little script once that takes an md5 checksum of most $PATH directories and uploads them to a remote server for intrustion detection. It was more academic than useful but you want the same concept:
install.sh
#!/bin/bash
if ( ! [ "$1" = "-f" ] ); then
echo ""
echo "Edit md5.conf before you proceed"
echo "once you are ready to install: "
echo "$0 -f"
echo ""
exit 0
fi
ifiles="/usr/sbin/md5check /usr/sbin/md5compare /usr/sbin/md5update /etc/md5.conf"
for i in $ifiles
do
if test -f $i; then
echo "Destination file already exists. Exiting"
exit 0
fi
done
cp md5check /usr/sbin
cp md5compare /usr/sbin
cp md5update /usr/sbin
cp md5.conf /etc
chmod 500 /usr/sbin/md5check
chmod 500 /usr/sbin/md5compare
chmod 500 /usr/sbin/md5update
chmod 400 /etc/md5.conf
chown root:root /usr/sbin/md5check
chown root:root /usr/sbin/md5compare
chown root:root /usr/sbin/md5update
chown root:root /etc/md5.conf
for i in $ifiles
do
chattr +i $i
done
md5.conf
# md5 tripwire config
# box hostname
hname=`hostname -s`
# server ip
sip=1.2.3.4
# server oirt
sport=22
#login name for remote machine
lname=sk
#directories to search (space delimited)
dsearch="/bin/ /sbin/ /usr/bin/ /usr/sbin/ /lib/ /usr/lib/ /usr/local/ /etc/ /boot/"
md5check:
#!/bin/bash
source /etc/md5.conf
if test `date +md5-$hname.%Y%m%d.txt`; then
rm -rf `date +md5-$hname.%Y%m%d.txt`
fi
echo ""
echo "Calculating md5 database"
for dir in $dsearch
do
find $dir -type f | xargs /usr/bin/md5sum >> `date +md5-$hname.%Y%m%d.txt`
done
echo "post installation md5 database calculated"
echo ""
md5compare
#!/bin/bash
source /etc/md5.conf
if ! [ "$UID" = "0" ]; then
echo "ERROR: Must be root to run"
exit 0
fi
oldfile="md5-$hname.txt.bak"
scp -P $sport $lname@$sip:~/.$oldfile.tgz . 2>/dev/null
if ( test -f .$oldfile.tgz ); then
tar -zxf .$oldfile.tgz
fi
rm -rf .$oldfile.tgz
if ( ! test -f $oldfile || [ "$oldfile" = "" ]); then
echo "Error retrieving md5 database from server"
exit 0
fi
md5check
newfile=`find ./ -iname *md5-$hname*.txt`
if ! test -f $newfile; then
echo "Error generating new md5 database"
exit 0
fi
diff $newfile $oldfile > changes
rm -rf md5-$hname* .md5-$hname*
if ( [ `cat changes|wc -l` -eq 0 ] ); then
echo "No changes were detected. Cleaning up."
rm -rf changes
else
echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
echo " Changes were detected. View _changes_ for details."
echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
fi
md5update:
#!/bin/bash
source /etc/md5.conf
logname=`date +md5-$hname.%Y%m%d.txt`
cpname="md5-$hname.txt.bak"
md5check
mv $logname $cpname
tar czf $cpname.tgz $cpname
echo "Please hit enter to continue."
read
scp -P $sport $cpname.tgz $lname@$sip:~/.$cpname.tgz 2>/dev/null
echo ""
echo "File copied to remote host"
echo ""
rm -rf $cpname
rm -rf $cpname.tgz