Check if there are changes on file system (Ubuntu 10.10)

Question

I have to get my PC to the service because sometimes the system hangs and suddendly reboots without any reason. Anyway, I will create a test user if they want to start the computer. Moreover I think about making a check of the file system before I brought and after I will get my PC back. I thought about a "#ls -alR > before.txt" out of the root directory. After I will get my PC back, I'll do the same and compare both files with the "diff" command (Maybe they have tried to install some crap). Is there a better solution for this?

Answer 1

ls -lR / would only tell you what the repair service did without trying to hide their tracks at all. If they want to install a trojan horse, they'll just use non-standard tools that don't use the normal channels to access the filesystem.

You should also run find / -xdev -type f -exec sha512sum {} + >before-checksums.txt. This stores a cryptographic checksum of every regular file. If the repair service modifies the files, it will show on the checksums. The boot sector is also vulnerable; keep a copy of it, as well as the first sector of every partition: for x in /dev/sda*; do head -c 512 <"$x" >"${x##*/}.sector1".

Even that might not be protection against a really determined and knowledgeable attacker. A cryptographic checksum of the whole disk would be but it would simply not match if they did as little as boot from the disk (which would update the filesystem's last mount time, write some log entries and so on).

When you retrieve the computer, make sure to boot from a live CD/USB and not from the system you get back, since if the system has been rootkitted the kernel will likely report original versions of the files and not the actual disk content (but will use the disk content to install some kind of backdoor during boot).

Of course, if they decide to read any private data on the disk, you won't know.

Why don't you just take the disk out?

(And hope they don't install a trojan firmware, for example on the motherboard (BIOS) or on the network card.)

Answer 2

If by "solution" you mean "having my system clean after I get it back from the service", it might be wise to consider making an image and restoring it afterwards - that way, you would be sure it's in the state you left it.

Also, you mention installing - if you make that user non-sudo, they would not be able to install anything anyway.

The method you suggested should work pretty well otherwise.