This module does not protect your site's file integrity. Only you can do that by configuring the site correctly and by not installing insecure software. It can be used to check a Drupal site for file integrity breeches.

This module lets the site maintainer “fingerprint” an entire site (except the files below the public:// upload directory) when it is in an untainted state. It can then be configured to periodically compare the site to this “fingerprint”, and report the following:

modified files and directories;
potential back-doors (files added to the site);
files removed from the site;
files writeable by the web-server.

This module should only be used on a stable production site to alert the site maintainer as a first line of defence against file integrity breeches.

Limitations

The module, as currently designed, is less suitable for large sites. It works well for sites with less than 6000 files, but becomes less usable if the site is larger than this. See README.md for details.

Notice

File integrity check considers having files (outside of the public:// upload directory) writable by the web-server a security hazard, and will warn about such files during fingerprinting. If you're installing this module for the first time, make sure this has been fixed before you fingerprint the site for the first time. (File integrity check will produce a lot of warnings if you don't do this.)

Explanation: Having executable PHP-files writable by the web-server is a major security hazard. This means that anyone that manages to compromise the web-server can escalate to a PHP-injection attack. The web-server has a very large attack surface, so it is one of the easiest targets for hackers attacking a Drupal site.

I recommend that the files that are part of Drupal is not owned by web-server user, but by some other user (for example the site owner), and having them readable (but not writeable) by the web-server group (mode bits 640). For example (joe is the site owner and www-data is the web-server group):

-rw-r-----   joe www-data   index.php

Requirements

Advanced help hint:
To hint about how to get README.md displayed.

Recommended modules

Advanced Help:
When this module is enabled, the project's README.md may be displayed on the screen.
Markdown filter:
When this module is enabled, display of the project's README.md will be rendered with the markdown filter.

Similar projects

The following projects may be applied to use cases that are similar to the use case this module was designed to handle:

File Integrity Check

Issues

Is this needed on Drupal 10?FixedDocumentation Created over 1 year ago

Is this needed on Drupal 10?
Fixed
Documentation
Created over 1 year ago