Tripwire

sudo apt install tripwire

setpassphrases ect during install

sudo tripwire --init

sudo tripwire --check

after editing the policy file do this:

sudo twadmin -m P /etc/tripwire/twpol.txt

sudo tripwire --init

sudo tripwire --check

if the passwords arn't set up for whatever reason:

sudo dpkg-reconfigure tripwire

References

https://www.howtoforge.com/tutorial/how-to-monitor-and-detect-modified-files-using-tripwire-on-ubuntu-1604/

https://www.digitalocean.com/community/tutorials/how-to-use-tripwire-to-detect-server-intrusions-on-an-ubuntu-vps