In my /etc directory there is something I do with files.
Let us say that I am looking at /etc/passwd.
What I do when it will be modified is to copy it over, in the following sense.
I have a hierarchy of files: passwd, passwd_1, passwd_2, passwd_3, …, passwd_n.
Before passwd is modified, I “rotate” the files (similar to logrotate).
passwd_n goes to passwd_n+1,
passwd_n-1 goes to passwd_n, ...
passwd_1 goes to passwd_2,
passwd copies to passwd_1.
Then I modify passwd.
What I would like to do vis à vis a checksum program like tripwire or AIDE is to "let them know I've rotated and allow them to update the checksums but also check that the rotation has gone smoothly.
Do either of there programs provide a way for specifying something like this?
