So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial numbers (not a great worry), grab the customer database (more of a worry) or do something sneaky like redirect legitimate payments to a different paypal account (which falls somewhere between the two in terms of worry).
I've been thinking I'd like to know if the PHP got altered. Would that pick up most intrusion attempts, and (while I'm at it) how would I pick up alterations further down the server stack? Is there a standard way of auditing changes to content?
The most secure option would presumably be a scheduled task on a different server that logs in periodically and compares the content to its own record. Is there an off the shelf, free tool that does this?