How do we do it ?

- To do an integrity check we can just simply save a copy of files in a very secure place
(non writable device cdrom ...) and compare the files on both sides periodically for changes.

- Some people like checking periodically on the time stamp and on the size.
(since comparison of the whole file takes time)

- Some people used to (or still do it) take a CRC of the original files and check
the CRCs periodically:

Example:
I am going to create a file test.txt:


[Simo@linux2 TEST]$ ls -la
total 12
drwxrwxr-x    2 Simo     Simo         4096 Jul 18 17:55 .
drwxrwxr-x    3 Simo     Simo         4096 Jul 18 17:55 ..
-rw-rw-r--    1 Simo     Simo            8 Jul 18 17:55 test.txt

The content of the file is :


[Simo@linux2 TEST]$ cat test.txt
abcdef

[Simo@linux2 TEST]$

Then I am going to change the content by adding a letter "g" to the file and an ls :

               
[Simo@linux2 TEST]$ ls -la
total 12
drwxrwxr-x    2 Simo     Simo         4096 Jul 18 17:55 .
drwxrwxr-x    3 Simo     Simo         4096 Jul 18 17:55 ..
-rw-rw-r--    1 Simo     Simo           10 Jul 18 17:59 test.txt

As you can see the time stamp changes and the size too.
and similarly with a check sum :

             
[Simo@linux2 TEST]$ cksum test.txt
3178362573 10 test.txt
[Simo@linux2 TEST]$ md5sum test.txt
1c60ad33a333804e6d7676a981a87486  test.txt

and after changing the content of the file again we can see the difference checksum wise:

 [Simo@linux2 TEST]$ cksum test.txt
3816876763 17 test.txt
[Simo@linux2 TEST]$ md5sum test.txt
0cb1e4f4e8acaec3bb43566ffd2efb94  test.txt

and you can compare the checksum values and see that it changed since some "sneaky"
intruders know how to change a file in there favor and keep the time stamp and
size the way they wanted....

-Some people decided to write pieces of code or script to accomplish file
integrity using some of the features talked about and add more integrity options and
tools too like the GID ... and links making those utilities check on a whole file system.