Originally a similar routine to this was run via /home/bcra/cron/demo/sh as
#!/bin/bash
# 06-July-11, based on /cron/ demo at mrsl-research.com
# run some crude tests to see if any files have been hacked
cd /home/bcra/public_html
grep -r -l -i 'CharCode' *.html *.php > /home/bcra/cron/greplog.txp
grep -r -l -i 'ParseInt' *.html *.php >> /home/bcra/cron/greplog.txp
grep -r -l -i 'eval(' *.html *.php >> /home/bcra/cron/greplog.txp
grep -r -l -i 'qwer1234' *.html *.php >> /home/bcra/cron/greplog.txp
# use php to send email containing size of greplog.txp and of BCRA web site index.html
php /home/bcra/cron/demo.php > /home/bcra/cron/demo_php_log.txp
echo "grep has been run to assemble a log for /home/bcra/cron/greplog.txp"
In this new version, we do not bother to GREP the files, we just look to see if some sizes have changed.
/home/bcra/public_html/index.html exists and has size 19003
http://sandbox.caves.org.uk/wellhouse/index.html could not be fetched from remote addressArray ( [type] => 2 [message] => file_get_contents(http://sandbox.caves.org.uk/wellhouse/index.html): failed to open stream: Connection timed out [file] => /home/bcra/public_html/data/cron/ping_file_sizes.php [line] => 119 )
http://caves.org.uk/index.html?norewrite exists and has size 1085
http://site2.caves.org.uk/index.html exists and has size 2193
http://shop.caves.org.uk/index.html?norewrite exists and has size 709
http://sandbox.caves.org.uk/wellhouse/index.html could not be fetched from remote addressArray ( [type] => 2 [message] => file_get_contents(http://sandbox.caves.org.uk/wellhouse/index.html): failed to open stream: Connection timed out [file] => /home/bcra/public_html/data/cron/ping_file_sizes.php [line] => 119 )
finished
08:02:03 on 23-Nov-2024 no_change cron=yes, bcra=19003, wellhouse=Xfetch, caves=1085, site2=2193, shop=709, sandbox=Xfetch
The log file will have a no-change character appended. That is, override $put with a dot
The no-change char will be a /, to mark the hour