Detect drift from a baseline you recorded yourself

applied · 70 min · Objective 1.3

Task

Record a configuration baseline, change the machine as an unrecorded change would, and build the check that detects the drift. This is the maintain stage of a baseline, which is the stage organisations skip.

Steps

  1. Record the baseline into /tmp/baseline.txt: the sorted list of enabled services (systemctl list-unit-files --state=enabled --no-legend | awk '{print $1}' | sort), the sorted list of listening sockets (ss -ltn | awk 'NR>1{print $4}' | sort -u), and a hash of /etc/ssh/sshd_config.
  2. Hash the baseline itself so you can prove it has not been edited: sha256sum /tmp/baseline.txt > /tmp/baseline.sha.
  3. Introduce drift the way it really happens — not maliciously, but as a quick fix someone made and did not record. Enable a service you do not need, or add a listening socket with python3 -m http.server 8081 --bind 10.99.0.10 &.
  4. Write /tmp/drift.sh: a script that regenerates the same three facts and diffs them against the baseline, exiting non-zero if they differ.
  5. Run it and confirm it reports the drift you introduced, naming the specific item rather than saying something changed.
  6. Revert the drift, run the script again, and confirm it now exits zero — a check that can only ever fail is not a check.

Verify

sha256sum -c /tmp/baseline.sha
bash /tmp/drift.sh; echo "drift.sh exit: $?"
bash /tmp/drift.sh 2>&1 | grep -ciE "8081|http.server|differ"

The first proves the baseline is the one you recorded and has not been quietly edited to match reality — which is the temptation this check exists to remove. The second must exit non-zero while the drift is present and zero after you revert it; run it both times. The third must be non-zero: the script names what drifted, because 'configuration has changed' sends somebody looking through the whole machine.

Notes

Notice that the baseline had to be hashed. A drift check compares reality to a record, and if the record is editable by whoever is being checked, a failing check can be made to pass by changing the wrong side. That is the same reasoning that puts logs on a different host in Domain 4.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.