File Integrity Monitoring (FIM) Execution Module

In a nutshell, this module collects FIM data from a minion. Collected data includes:

• hashing algorithm
• file atime
• file checksum
• file ctime
• file gid / group
• file inode
• file mode (permissions)
• file mtime
• file size
• file target (full path)
• file type
• file uid / user

Runtime

This module is flexible regarding what data is captured, and how it is returned. Primary options (runtime or configured) include:

• algo (md5, sha1, sha224, sha256 (default), sha384, sha512)
• targets (file or directory path. directories will be recursed)
• filename (output filename to save compressed (gzip) output)

CLI Example:

salt '*' fim.checksum algo='sha1' targets='['/usr/sbin/sshd', '/etc']'

salt '*' fim.checksum targets='['/bin', '/sbin', '/usr/bin', '/usr/sbin']'

salt '*' fim.checksum targets='['/etc']' filename='/var/log/salt/fim.log.gz'

Example #1: use sha1 hash algorithm to recursively hash the defined targets list.

Example #2: use default hash algorithm to recursively hash defined targets list.

Example #3: use default hash algorithm to recursively hash defined targets list and write to defined filename path.

Configuration

An example config file, (/etc/salt/minion.d/fim.conf) for this module could look something like this:

fim:
  algo: sha256
  filename: /var/log/salt/fim.log.gz
  targets:
    - /bin
    - /sbin
    - /usr/bin
    - /usr/sbin
    - /usr/local/bin
    - /usr/local/sbin