Linux diff Isn't Just for Code: Catch Config Drift Before It Bites

You already use git diff every day. Point the same idea at a config file and it becomes a security tool.

Config drift is one of the quietest problems on Linux servers. Changing PermitRootLogin from no to yes in sshd_config breaks no build and fails no review. It just sits there.

Plain diff, checked against a protected baseline, catches it in seconds. My full guide covers:

• diff -u for readable unified output (Git uses the same style)
• diff -rq dir1 dir2 to list changed files across a whole tree
• Exit codes 0, 1, and 2 for reliable script checks
• Ignore flags (-i, -w, -B) for triage, and why to re-run without them
• A read-only Bash check that logs drift to syslog for your SIEM

Bonus: process substitution compares command output with no temp files:

diff baseline.txt <(cut -d: -f1 /etc/passwd | sort)

Educational, defensive-security content for SOC analysts, sysadmins, and developers.

Full tutorial: https://www.xpert4cyber.com/2026/09/linux-diff-command-tutorial.html

How do you track config drift today: diff, hashes, Git, or an FIM tool?