Automated Server File Integrity Checker with Slack Alerts - n8n Workflow

DevOps and System Administrators: Individuals responsible for maintaining server security and requiring automated monitoring for critical configuration files.
IT Security Teams: Organizations needing early detection of unauthorized file modifications or potential intrusions.
Managed Service Providers (MSPs): Companies looking to offer automated security monitoring features to their clients using an n8n solution.
n8n Users: Anyone seeking advanced n8n templates showcasing SSH integration and conditional logic for security tasks.

Server file integrity is a foundational element of cybersecurity. Unexpected modifications to critical configuration files or scripts can signal a malware infection, unauthorized access, or a major system failure. Manually monitoring these files is impractical and prone to error.

This robust n8n workflow provides a simple, automated solution to this security challenge. The automation uses the power of an n8n trigger to initiate a scheduled check. It connects securely to your remote server via SSH, calculates the current cryptographic checksum (SHA256) of specified files, and compares this current value against a known, valid checksum stored within the n8n node logic.

If the checksums do not match, indicating even the smallest change to the file contents, the n8n workflow immediately sends a detailed security alert to your specified Slack channel, allowing your team to react instantly. This n8n workflow is a vital layer of defense for small and medium businesses relying on self-managed infrastructure.

This powerful security n8n workflow operates through five interconnected steps, starting with a crucial n8n trigger:

1. Scheduled Start: The Scheduled Check n8n trigger (Cron node) initiates the entire n8n workflow at predetermined intervals (e.g., daily at 3 AM), ensuring consistent auditing.


2. Define Targets: The List Files & Checksums n8n node (Code node) acts as a static data source. Here, the user defines an array containing the path of each critical file and its associated, verified 'good' checksum. This data is passed downstream for processing.


3. Remote Verification: The Get Remote File Checksum n8n node (SSH node) takes the file path defined in the previous step, securely connects to the remote server, and executes the sha256sum command to calculate the file's current cryptographic hash.


4. Conditional Check: The Checksums Match? n8n node (If node) is the core logic. It compares the known checksum (from the Code node) against the current checksum returned by the SSH node. If the values are not equal (signifying modification), the workflow follows the true path.


5. Alert or End: If the checksums mismatch, the workflow executes the Send Alert n8n node (Slack) to notify the security team. If the checksums match, the workflow is routed to the End Workflow (No-Op node), terminating safely without sending unnecessary notifications. This efficient structure ensures that the n8n workflow only demands attention when a security event occurs.

To deploy this security-focused n8n workflow template, follow these steps:

1. Import: In your n8n instance, click 'New' > 'Import from JSON' and paste the provided JSON code.


2. Set up SSH Credentials: You must configure an SSH credential in n8n, providing the hostname, port, username, and either a private key or password for your remote server. Ensure the user has permissions to run sha256sum on the target files.


3. Set up Slack Credentials: Configure your Slack API credential in n8n, granting the necessary permissions to post messages to your chosen channel.


4. Configure Target Data (Code Node): Open the List Files & Checksums n8n node. You must replace the placeholder code with an array defining your critical file paths and their manually verified, known-good checksums (knownChecksum).


5. Configure SSH Node: Select the SSH credential you created.


6. Configure Slack Node: Select your Slack credential and replace the placeholder [YOURSECURITYALERTCHANNELID] with the actual Channel ID where alerts should be sent.


7. Activate: Once credentials and data are correctly configured in every n8n node, activate the n8n workflow.

Scheduled Check (Cron n8n node):
Function: Serves as the primary n8n trigger, scheduling the integrity check to run automatically at a defined interval.
Key Configuration: Schedule settings (e.g., daily, hourly).
List Files & Checksums (Code n8n node):
Function: Holds the critical data—the list of file paths to monitor (path) and their baseline, verified checksums (knownChecksum). This must be manually updated by the user.
Key Configuration: Requires custom JavaScript to output an array of objects containing path and knownChecksum fields.
Get Remote File Checksum (SSH n8n node):
Function: Executes the sha256sum command on the remote server, pulling the current checksum for the file specified by the upstream n8n node.
Key Configuration: Command: sha256sum {{ $json.path }}. Requires selection of SSH credentials.
Checksums Match? (If n8n node):
Function: Compares the two checksum values. It branches the n8n workflow path: alerts if they are different, ends silently if they match.
Key Configuration: Condition logic to check if currentchecksum != knownchecksum.
Send Alert (Slack n8n node):
Function: Sends a detailed notification to the security channel, identifying the modified file and listing both the expected and current checksums.
Key Configuration: Text field uses expressions to format the alert: File: {{ $json.path }}* has been modified!