#!/bin/bash
#   check a number of files to see if they have been tampered with, in case of a ransomware attack
#   prepare:
#   create a gpg private key:    gpg --full-generate-key
#   create folder /opt/filesOk
#   create signature file like: gpg --output file6 --detach-sig /root/plex.README
#   verify as in below.

out="/tmp/fileIntegrity.log"
date >>${out} 

log="/tmp/filesOk.txt"
cd /opt/filesOk
gpg --verify file1 /media/plex/Photos/2010-07-24\ 14.09.24.jpg >${log}  2>&1
gpg --verify file2 /media/plex/CDs/ABBA/Waterloo/01\ Waterloo.mp3 >>${log}  2>&1
gpg --verify file3 /media/plex/Gelul/Harrie\ Jekkers/Het\ gelijk\ van\ de\ koffietent/01\ De\ wonderen\ zijn\ de\ wereld\ uit.mp3 >>${log}  2>&1
gpg --verify file4 /var/www/owncloud/data/ignace/files/DocumentsSamen/Administration/Huisagendas/huisagenda\ 2019.pdf >>${log}  2>&1
gpg --verify file5 /var/www/owncloud/data/janine/files/2019/Adreswijzigingen.docx >>${log}  2>&1
gpg --verify file6 /root/plex.README >>${log}  2>&1
gpg --verify file7 /root/SAVEIPS >>${log}  2>&1

if [ $(grep -c BAD ${log}) -gt 0 ] ; then
    echo "FILE has been changed". >>${out}
    /usr/local/bin/addEvent.sh "ERROR,GPG1,1,1,Tampering! A file signature failed. Check integrity of your files."
else
    echo "All files unchanged :-) " >>${out}
    /usr/local/bin/addEvent.sh "INFO - All pgp file signature checks were fine."
fi