.\" Automatically generated by Pod::Man 4.10 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "FCHECK 8"
.TH FCHECK 8 "2019-03-02" "perl v5.28.1" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
fcheck \- IDS filesystem baseline integrity checker
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
fcheck [\s-1OPTIONS\s0]
.SH "OPTIONS"
.IX Header "OPTIONS"
The options to fcheck are defined below:
.IP "\fB\-a\fR" 4
.IX Item "-a"
Automatic mode, do all directories in configuration file.
.IP "\fB\-c\fR" 4
.IX Item "-c"
Create a new base line database for the given directory.
.IP "\fB\-d\fR" 4
.IX Item "-d"
Directory names are to be monitored for changes also.
.IP "\fB\-f filename\fR" 4
.IX Item "-f filename"
Use alternate 'filename' as the configuration file.
.IP "\fB\-i\fR" 4
.IX Item "-i"
Ignore creation times, check permissions, adds, deletes only.
.IP "\fB\-h\fR" 4
.IX Item "-h"
Append the \f(CW$HOSTNAME\fR to the configuration filename.
.IP "\fB\-l\fR" 4
.IX Item "-l"
Log information to logger rather than stdout messages.
.IP "\fB\-r\fR" 4
.IX Item "-r"
Report mode, great for emailed status reports.
.IP "\fB\-s\fR" 4
.IX Item "-s"
Sign each file with a CRC/hash signature.
.IP "\fB\-v\fR" 4
.IX Item "-v"
Verbose mode, not used for report generation.
.IP "\fB\-x\fR" 4
.IX Item "-x"
eXtended unix checks, # of links, \s-1UID, GID,\s0 Major/Minor checks.
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
.SS "Overview"
.IX Subsection "Overview"
The fcheck utility is an \s-1IDS\s0 (Intrusion Detection System)
which can be used to monitor changes to any given filesystem.
.PP
Essentially, fcheck has the ability to monitor directories, files
or complete filesystems for any additions, deletions, and modifications.
It is configurable to exclude active log files, and can be ran as often
as needed from the command line or cron making it extremely difficult to
circumvent.
.SS "Operation and Getting Started"
.IX Subsection "Operation and Getting Started"
Flag passing is a fairly simple process. Primarily you will be using two
commands. One builds (or rebuilds) your baseline database files (system
snapshots). The second runs in a scanning comparison mode.
.PP
\&\f(CW"fcheck \-ac"\fR
.PP
Builds the baseline database.
.PP
\&\f(CW"fcheck \-a"\fR
.PP
Comparison scans the system against the baseline database.
.PP
For normal operation: Initially you will run fcheck by issuing the command
\&\*(L"fcheck \-ac\*(R" to create the initial baseline file used for comparison. Any
runs after the creation of the basline will normally be with the following
flags "fcheck \f(CW\*(C`\-a\*(C'\fR" to scan for any system modifications.
.PP
After a scan is completed, you will probably want to have fcheck re-create its
baseline database for the next comparison cycle. Otherwise you will be seeing
every system modification since the last baseline re-build. In other words, run
the \f(CW"fcheck \-ac"\fR command again.
.PP
(Advanced Note:)
A more intensive system check would be accomplished by building your database
to include \s-1GID/UID\s0 checks, directories, and \s-1CRC\s0 checks by using the following
sample syntax:
.PP
.Vb 1
\&  "fcheck \-cadsxlf /etc/fcheck/fcheck.cfg"
.Ve
.PP
And provide periodic integrity scans from cron by using the following sample
syntax:
.PP
.Vb 1
\&  "fcheck \-adsxlf /etc/fcheck/fcheck.cfg"
.Ve
.SH "AUTHOR"
.IX Header "AUTHOR"
Author: Copyright (C) 1996 Michael A. Gumienny <gumienny@hotmail.com>
.PP
Debianized by: Graham Simpson <gsi@eggconnect.net>
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Please also refer to the excellent \s-1README\s0 and \s-1INSTALL\s0 instructions provided with
the package \fI/usr/share/doc/fcheck\fR.