Is there a practical way to identify and diff, after the fact, which config file modifications (i.e. files under /etc/) have been modified, i.e. are different to the defaults?
(Asking primarily for Debian and Centos, but answers for other Linux flavours are also welcome.)
You can use debsums for finding changes in general or use a diff-script provided here: Get diff changes between original files installed with apt and current files
debsums won’t work for the vast majority of files in /etc, they’re not covered by the checksum files provided by the packages. However the solution given in your link is useful for Debian.
– Stephen Kitt
Apr 30 '18 at 14:29
etckeeperbut needs to be installed before changes. It will keep a record of all changes. It uses your favourite revision control system, so allows diffs. – ctrl-alt-delor Apr 30 '18 at 11:32