Lion Cipher Lab
Track /etc configuration drift with git and a Python differ
- Cyber / Security Engineer
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A freshly hardened server is a snapshot in time. From the moment it goes live, its configuration begins to drift: a teammate loosens an SSH setting to debug something and forgets to revert it, a package update rewrites a config file, someone adds a sudoers rule 'just for now,' or — the case that matters most — an attacker who got in drops a new authorized SSH key or a cron job to keep their foothold. Every one of these looks the same from a distance: a file under /etc is now different from how you left it. The problem is that nobody can hold the known-good state of a few thousand config files…
What you'll learn
- what configuration drift is and why it is a security problem
- putting /etc under version control (the etckeeper pattern, by hand)
- reading git diff --name-status output
- writing a Python drift classifier with stdlib only
- separating security-sensitive config changes from routine churn
- baseline configuration management per NIST SP 800-128
- alerting on drift with an exit code and a scheduled job
Steps in this lab
- What drift is, and the baseline idea underneath the fix
- Put /etc under version control — capture the baseline
- See the raw drift with git diff --name-status
- Write the drift classifier
- Run it and read the triaged report
- Schedule it, and know when to reach for the real tools