How to Track Changes in /etc Automatically on Ubuntu Server Using etckeeper and Git

The /etc directory is the administrative nerve centre of an Ubuntu Server, housing daemon configurations, firewall policies, user registries, and network interfaces. When troubleshooting broken system services after a configuration update or debugging unexpected package upgrades, determining who modified a configuration file, what lines changed, and when the modification occurred is often impossible without dedicated tracking.

The etckeeper utility automates revision control for the entire /etc directory by binding it to a local Git repository. Operating silently in the background, etckeeper commits configuration states before and after every apt package installation, logs manual configuration adjustments, and preserves critical Linux file permissions and ownership metadata that standard Git repositories disregard.

Installing etckeeper and Initialising Git on Ubuntu Server

Ubuntu includes etckeeper in the universe repository:

1. Update package indexes and install etckeeper alongside git:

sudo apt update && sudo apt install -y etckeeper git

2. Open the master configuration file to verify your preferred Version Control System (VCS):

sudo nano /etc/etckeeper/etckeeper.conf

3. Confirm that VCS="git" is uncommented (this is the default on modern Ubuntu releases). Ensure alternative VCS options like bazaar or mercurial remain disabled.
4. Save and exit the configuration file.

Initialising and Committing the /etc Repository

If not initialised automatically during package installation, execute the initial commit manually:

1. Initialise the Git repository within /etc:

sudo etckeeper init

2. Commit the initial system configuration baseline:

sudo etckeeper commit "Initial baseline commit of /etc filesystem"

The utility creates a hidden /etc/.git repository and stores an initial snapshot of all configuration assets.

Automatic Commits During APT Package Operations

Once active, etckeeper automatically attaches hook scripts to the APT package manager:

• Pre-installation Hook: Before packages are upgraded or removed, etckeeper scans for uncommitted changes in /etc and commits them to prevent state collisions.
• Post-installation Hook: After APT completes installing or upgrading packages, etckeeper generates a commit documenting any new default configuration files, modified package parameters, or removed assets.

To inspect your server’s configuration modification history:

cd /etc
sudo git log --oneline -n 10

Each commit message clearly identifies the triggering event, such as saving uncommitted changes in /etc prior to apt run or committing changes in /etc after apt run.

Recording Manual Configuration Changes

When manually editing services (such as updating an Nginx virtual host or adjusting SSH port security), use etckeeper commit to document your alterations with descriptive messages:

1. Edit your target configuration file (for example, /etc/ssh/sshd_config):

sudo nano /etc/ssh/sshd_config

2. Inspect the modification diff before committing:

sudo etckeeper vcs diff

3. Commit the verified changes to version control:

sudo etckeeper commit "Disable SSH password authentication and enforce Ed25519 keys"

Rolling Back Faulty Configuration Changes

If an erroneous configuration edit causes a system service to crash, you can leverage Git commands directly through etckeeper to revert changes safely:

1. Inspect recent commit history for a specific configuration file:

sudo etckeeper vcs log -p /etc/nginx/nginx.conf

2. Restore the file to its previous committed working revision:

sudo etckeeper vcs checkout HEAD~1 -- /etc/nginx/nginx.conf

3. Commit the restoration to maintain clean audit records:

sudo etckeeper commit "Reverted nginx.conf to previous working revision"

Preserving Linux Permissions and Metadata

Standard Git repositories only track basic executable flags and ignore custom UNIX file ownership (UID/GID) and restrictive permissions (such as chmod 600 on shadow files or SSL certificates).

etckeeper overcomes this limitation by maintaining a dedicated metadata file located at /etc/.etckeeper. Every time a commit occurs, exact POSIX permissions, user ownership, and group associations are recorded. If files are checked out or restored, etckeeper automatically reapplies the exact security permissions to ensure sensitive keys and passwords remain protected.