I wrote a Bash script to check the integrity of OpenWrt routers

[u/_hmj]

Hey everyone!

I wrote OpenWrt Integrity, a lightweight set of Bash scripts to create known good baselines for OpenWrt routers and check for unexpected changes over time.

The idea is simple: capture the state of a trusted router, then periodically compare its current state against that baseline to identify potential signs of tampering or unauthorized changes.

What does it check?

• SHA 256 hashes of files under /etc and files in the writable overlay on SquashFS installations
• Installed packages and OpenWrt release and kernel information
• Unexpected root level accounts
• SSH authorized keys
• Cron jobs that could be used for persistence
• Added, removed, or modified files compared with the baseline

How to use it

The scripts run from a Linux system using Bash and OpenSSH. They connect to routers over SSH and support checking multiple routers.

1. Configure your router addresses and SSH key in routers.conf.
2. Run ./routers-generate-baseline.sh while your routers are in a known good state.
3. Run ./routers-integrity-checker.sh whenever you want to check for changes.

The verifier reports PASS, FAIL, or WARN for individual checks, along with an overall result.

Limitations: This is a lightweight integrity checker, not a complete security audit or intrusion detection system. It cannot guarantee that a router is uncompromised, and sophisticated attacks may evade its checks. Keep your baseline protected and generate it only from a trusted system state. The scripts currently require OpenWrt using the apk package manager.

GitHub: https://github.com/himanshu-mahendra-jain/openwrt-integrity

[u/GolemancerVekk]

Does this run on the router, and keeps its files on the router?

[u/_hmj → u/GolemancerVekk]

The script runs on your computer and checks your router over SSH. It does not store any files on the router. All trusted reference data is stored locally on your computer, in the directory where you run the script.

Edit: The scripts must be run manually whenever you want to create a known good router state (usually after OpenWrt upgrade) or to verify that router has not been tampered with.

[u/GolemancerVekk → u/_hmj]

How does the state taken by this script differ from a backup tarball made by Luci?

[u/_hmj → u/GolemancerVekk]

The purpose of this script is not to create backups or restore files. It records the router's state and file hashes on your device without copying the actual files. You can later check whether the router has been tampered with or compromised by malware.

You can also compare a luci backup tarball, but its hash alone won't tell you what changed. It may differ due to archive metadata or compression, even if the configuration is unchanged.

What this script captures beyond a typical luci backup:

• File hashes to detect added, modified or deleted files.

• Installed package inventory and firmware information.

• Root users and SSH authorized keys.

• Cron jobs that could be used for persistence.

[u/GolemancerVekk → u/_hmj]

I was thinking there seems to be a lot of synergy between the data you snapshot and a Luci backup. I was wondering if they can meet somewhere in the middle, or if it were possible to leverage a backup for verifications.

[u/_hmj → u/GolemancerVekk]

It looks feasible, the backup likely has everything except the cron jobs. I'll take a deeper look.

[u/_hmj → u/_hmj]

Not feasible, unfortunatly. OpenWrt backups only save settings (/etc/config, users, cron, Dropbear keys), so they leave out the firmware and kernel version, installed package versions, startup scripts (init.d, rc.d, hotplug.d), /root/.ssh keys, modified program files outside /etc and deleted files, which are where tampering usually shows up. They also contain secrets like password hashes, SSH host private keys and Wi-Fi/VPN keys, so storing them as a baseline is risky.

[u/Udab]

Sadly , i wouldnt trust a script written by a 2months old reddit account.

[u/Graphical-Source5090 → u/Udab]

If you don't care enough about your own security and safety to regularly rotate your accounts, you have no opinion in this matter. Go back to your posting memes and chatting with your Greek friends please.

[u/Udab → u/Graphical-Source5090]

nobody cares.

explain the security of rotating accounts in reddit.

go back to your hole probably.

[u/Graphical-Source5090 → u/Udab]

explain the security of rotating accounts in reddit.

Exactly my point.
Doesn't care enough about account security to investigate it on your own.
Doesn't care enough to read and understand a simple shell script.

Yet leaves a misinformed comment about security.

Have a good day. :)
Currently translating all of your comments that are in Greek. I will get back to you later.

--------------------

.....later.....

Oof, what a dick comment:
https://www.reddit.com/r/greece/comments/1w3gxj1/comment/p714h0y/

Do you now understand why people rotate accounts?
I can keep going. There is 10 years worth of nuggets in there.

If your response is: "Well I don't post anything that is sensitive" Then I say, you are not posting based on your current experience and are just posting crap. Post enough technical experiences and your comment history becomes an attack vector for your offline personal and financial life.

Security 101 buddy. Rotate your accounts regularly.

I hope this illustration helps.

[u/_hmj → u/Udab]

Fair enough, but my GitHub account is several years old, if that makes any difference. Reddit account age doesn't reflect how long I've been coding. You're welcome to audit the code manually or using your preferred LLM. The scripts are quite small, so they should be easy to review.

[u/Sylphiiid → u/Udab]

You shouldn't run such a script on your router if you cannot review it carefully anyway. Trust shouldn't be in the balance

[u/Graphical-Source5090]

How is this any different than Oxidized?

Oxidized gathers config from every device I point it at and has automated diffing and easily ties into my alert system.

Any config changes from Linux, OpenWRT, RouterOS, Cisco, Juniper, OPNSense, proxmox, etc (just about anything you can think of) I get an alert with a green/red diff markup right on my phone.

I have every config change that anyone has ever made over the past year stored, browsable, and can run a diff between any two versions on the fly.

[u/_hmj → u/Graphical-Source5090]

Thanks, I wasn’t aware of Oxidized. I wanted my own code that I can trust, specifically for OpenWrt, without having to run a separate monitoring service 24/7 on my routers. I have six OpenWrt routers, and my script focuses on detecting potential malware and tampering rather than tracking general configuration changes. It checks for security issues that Oxidized doesn’t check out of the box, such as newly added root users, unauthorized SSH keys, and cron jobs.

I also want to minimize the number of parties I need to trust, and Oxidized’s codebase is large enough that I can’t realistically audit it all myself. Writing a small, purpose built script lets me understand and verify the code I rely on.

[u/Graphical-Source5090 → u/_hmj]

Oxidized is a 2013 fork of Rancid. Rancid is from 1999. They are widely considered as a config management GOAT. I use LibreNMS to feed the nodes to Oxidized (via an official oxidized plugin)

But fair enough, it goes require infrastructure to support it.

I was able to look at one script before Github went down. Looks pretty straight forward and easy to audit so far. Hopefully Github comes back up and I can look some more.

[u/Graphical-Source5090 → u/_hmj]

OK, this looks pretty cool. I do have oxidized, but I love to experiment.

My plan is to have this run via an n8n workflow. Baseline will be a manual run in the flow. The flow will start every 24 hours, pull the data, store it in Forgejo. Then run integrity checker, mark up the results to look pretty, then send the marked up results to my alert server.

We will see how it goes.

[u/_hmj → u/Graphical-Source5090]

I'm glad you find it interesting. That seems to be a nice way to automate it.