Integrity and changes
When files change – and when the system shifts.
Two related but different questions: has an important file changed? and what is different about the system compared to last time?
File integrity #
NODE64 computes checksums of a fixed set of important files – accounts, permissions, SSH configuration, cron, services. On the first run the state is stored as a baseline, without a finding. If a file deviates later, an integrity finding appears.
The rating depends on the path: a changed sshd_config weighs more than a changed /etc/hosts.
The server only knows the checksum, not the content. It knows something changed – not what. That is deliberate: for the question "did somebody touch this?" a checksum is enough, and anything beyond it would be a copy of your configuration on someone else's hardware.
Confirming as intended #
Most changes are your own. The finding offers Confirm as intended – one click, and the new state becomes the reference point. The finding is closed, and you are only told again when the file changes once more.
Two details:
- The state confirmed is exactly the one shown in the finding. If the file changed again since you opened the page, the click is rejected – otherwise you would confirm somebody else's change along with yours.
- The baseline does not move automatically just because you looked at the finding. An integrity alert that resolves itself is silent the next time – and the next time is the one that counts.
Changes to the system #
Independently of files, NODE64 compares each run with the previous one and reports what shifted:
- newly installed or removed packages,
- new or vanished listening ports,
- new or removed accounts,
- services that appeared or disappeared,
- new containers.
This is not a security verdict but a record. Its value shows in daily life: if a port opens on a server nobody worked on, you know before anyone else notices.
Typical case: an automatic update pulls in a package that brings a service listening on all interfaces. Nobody did anything wrong – yet the server is reachable differently than it was yesterday.