Tripwire
From FGARWiki
Tripwire is installed on the VPS that hosts both the FGARWiki and the Official FreeGeek Arkansas Website. Part of that installation is a daily cronjob that will print a report, which cron will email to the local "root" account. All of the VPS administrators should be receiving these emails daily, although the reports should not indicate any errors. Not receiving a Tripwire report indicates that the system is either broken or compromised.
The text version of the tripwire policy is stored at /etc/tripwire/twpol.txt, any modifications should be followed by a policy update via the command (tripwire --update-policy /etc/tripwire/twpol.txt). This will require both the site and local passphrase, which must be obtained via a secure channel from an existing administrator.