Install etckeeper from your Linux distribution, let it initialize /etc, then use its configured version-control system to review, commit, and recover configuration changes. On Ubuntu and Debian, package hooks record changes made by APT, while daily commits provide a safety net. You should still create named commits for important edits, inspect diffs before restoring anything, validate services after a rollback, and protect the repository as carefully as the live configuration because /etc can contain credentials, private keys, and security policy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What etckeeper puts under version control
/etc is the operating system’s central configuration tree. It contains service settings, account and authentication policy, network configuration, scheduled-task definitions, package-maintainer files, trust settings, and often files whose permissions are security-critical. A conventional Git repository does not preserve every piece of filesystem metadata that matters to those files. etckeeper adds the integration needed to track /etc as an administrative working tree and records metadata such as permissions, including sensitive modes like those on /etc/shadow.
As an Amazon Associate I earn from qualifying purchases.
The result is host-local history: you can identify what changed, associate a change with a commit and (when privilege escalation was used) the original username, compare package transactions, and recover from an accidental edit. The upstream project describes the purpose as using Git to review or revert changes made to /etc. It is not a secret-management service, a fleet-management platform, or a substitute for tested disaster recovery.
Install etckeeper on Ubuntu or Debian
Use the distribution package rather than copying scripts into /etc. On an Ubuntu or Debian host, run:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
sudo apt update
sudo apt install etckeeperUbuntu documents that installation normally initializes the repository and creates an initial commit. The principal configuration file is /etc/etckeeper/etckeeper.conf. Ubuntu uses Git as the default backend, but the effective backend is a configuration choice, so verify it rather than assuming.
Check the repository immediately
Run the version-control commands through etckeeper. The vcs subcommand executes the configured backend command in /etc:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo etckeeper vcs status
sudo etckeeper vcs log --oneline --decorate -n 10A clean status means the files currently match the latest commit; a list of modified or untracked files means there is already configuration drift to review. The log should show the installation-time commit and any subsequent history. If your policy requires removing initialization, Ubuntu documents:
sudo etckeeper uninitUse that command deliberately: removing the repository eliminates the local history that makes later comparison and recovery possible.
Configure the backend and automatic behavior
Open /etc/etckeeper/etckeeper.conf to see the selected version-control system and automation settings. The exact variable names and defaults are distribution-specific, but Ubuntu’s package uses Git by default. Keep the distribution’s normal hooks enabled unless you have an equivalent, documented operating procedure.
Daily commits
Ubuntu documents daily commits of uncommitted /etc changes by default. This catches edits made outside a carefully planned maintenance window, but a date-based commit does not explain why a setting changed. The setting AVOID_DAILY_AUTOCOMMITS disables this behavior. If you turn it on, replace the safety net with a reliable scheduled or manual process; otherwise changes can remain unrecorded until the next package transaction or administrator review.
Recommended Free Tools
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Package-manager hooks
etckeeper integrates with APT so package installation and upgrades are represented in history. The hooks commit before and after package operations, allowing you to distinguish a maintainer-script or package-default change from a hand edit. To observe the workflow on a test or maintenance host, install a package that changes configuration, such as:
sudo apt install postfixAfter the transaction completes, inspect the log and the relevant diff. The package configuration changes should appear in a commit associated with that operation. A hook records the filesystem state; it does not explain whether a new default is appropriate for your service, so read the diff before accepting the result.
Record a deliberate configuration change
For an intentional change, use a short, specific commit message. The sequence below leaves an auditable trail and lets you abandon the edit before it reaches history.
- Edit with the normal administrative tool. For example, open the SSH daemon configuration with
sudoedit /etc/ssh/sshd_config.sudoeditedits a temporary copy and installs it with the correct privilege boundary. - Inspect the exact diff. Limit the output to the file you changed:
sudo etckeeper vcs diff -- /etc/ssh/sshd_config- Validate syntax before committing. Use the service’s own configuration-test command where one exists. For an SSH daemon, run the syntax check appropriate to the installed implementation before reloading it. A version-control commit records bytes and metadata; it does not certify that a daemon will accept them.
- Commit the complete
/etcstate with a reason.
sudo etckeeper commit "Harden SSH authentication settings"The etckeeper manpage states that this commits all /etc changes, not only the file you just inspected. It also records the original username when sudo or su was used to become root. Check status again so that unrelated edits are not accidentally left unexplained:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sudo etckeeper vcs statusIf several administrators work on the host, agree on message conventions such as the service name, purpose, and change ticket. A useful message answers “why” without forcing a future operator to reconstruct intent from a one-line diff.
Find who changed a setting and when
Start with the narrowest history query that answers the question. You can inspect a service directory, compare adjacent revisions, or attribute individual lines.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Review a service’s commits
sudo etckeeper vcs log -- /etc/nginxThis shows commits that touched the Nginx configuration tree. Replace the path with the service or file you are investigating. Read the commit message and author information before opening the patch; package-generated commits and named maintenance commits often have different operational implications.
Compare revisions
sudo etckeeper vcs diff HEAD~1..HEAD -- /etc/nginxThe range compares the newest commit with its parent for the selected path. For a wider incident review, first list the relevant commits with log, then compare the known-good revision with the suspect revision. Do not rely on the latest commit alone when a package upgrade created several related changes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Attribute individual lines
sudo etckeeper vcs blame /etc/ssh/sshd_configBlame output associates each line with a revision and author. Treat it as a starting point, not proof of causation: a line may have been moved by a formatting change, generated by a package, or committed during a broad administrative operation. Open the referenced commit to see the surrounding context.
Undo a bad edit without creating a second outage
A rollback writes old content into the live /etc tree. That can immediately alter authentication, networking, storage, firewalling, or service startup behavior. etckeeper gives you history and VCS access; it cannot determine whether an older configuration is safe for the current package versions, certificates, users, or data paths. Use a controlled sequence.
- Preserve the current state. Record the current commit and copy any diagnostic output. If the working tree contains an emergency fix that has not been committed, save it separately before restoring an older revision.
- Identify the target revision. Use
sudo etckeeper vcs logand a path-limited diff to find the last known-good state. Confirm that the revision includes compatible files, ownership, and permissions for the service you will restart. - Inspect the proposed rollback. Compare the target with the current state before writing anything. Look for collateral changes in included files, not just the setting that triggered the incident.
- Restore with the configured backend from
/etc. With Git, a modern equivalent is:
cd /etc
sudo git restore --source=<known-good-commit> -- ssh/sshd_configReplace the commit identifier and relative path with the values you verified. On a backend other than Git, use that backend’s checkout or restore command through the configured VCS. Restoring a directory can change many live files, so name only the paths required for the recovery whenever possible.
- Review the post-restore diff.
sudo etckeeper vcs diff- Run syntax checks and validate the affected service. Test configuration, reload or restart according to the service’s runbook, and verify its health from the same access path users depend on. For remote access changes, keep an existing session open while testing a new one.
- Commit the recovery state with an explanation. A recovery commit preserves the incident trail and prevents the next daily or package hook from obscuring what happened.
If the rollback itself is wrong, the new commit and the prior history give you a defined point from which to return. Never use a blind “reset everything” operation on a production host when a path-specific restore will solve the problem.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Understand what package upgrades look like in history
Package upgrades can edit files in several ways: replacing a default, merging a maintainer change, creating a new drop-in, or running a post-install script. etckeeper’s APT hooks capture the before-and-after states, so history can answer whether a service changed during a transaction even when no administrator opened the file.
When investigating, correlate the package operation’s time with the commit timestamps, then inspect the actual patch. A package commit may include unrelated files touched by the same transaction. Keep a named follow-up commit for any local decision, such as choosing a maintainer-provided default or documenting why a local override remains.
Automatic commits improve coverage, but they do not replace maintenance discipline. Before a planned upgrade, record the working-tree status and ensure there is a recent backup of the host’s operational data. Afterward, review configuration changes for services that affect authentication, network reachability, encryption, storage, and scheduled jobs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect the repository and its history
The repository is not harmless metadata. A configuration tree can contain password hashes, API credentials, private keys, certificate material, host identifiers, access-control rules, and details that make an attack easier. etckeeper does not redact secrets, and ordinary Git storage is not encryption.
- Restrict local access. Preserve root ownership and restrictive permissions for the repository and its object database. Include the repository directory in host-hardening reviews.
- Control remote access. If you copy history elsewhere, use an access-controlled private destination and an encrypted transport. Give the remote only the administrators and automation identities that need it.
- Assume history retains old secrets. Deleting a credential from the current file does not remove it from earlier commits. Rotate exposed credentials and use a deliberate history-scrubbing process if policy requires removal.
- Separate backup from authorization. A remote clone is another copy of sensitive data. Its retention, encryption, access logging, and deletion policy must be documented.
Metadata preservation matters as much as text. A restored file with the right contents but an unsafe owner or mode can create a new vulnerability, which is why etckeeper’s metadata tracking is important for files such as /etc/shadow.
Use etckeeper hooks for maintenance and backup copies
Upstream etckeeper runs executable hook files in /etc/etckeeper/$command.d/. Hooks let administrators add narrowly defined actions around commands without modifying the main program.
Examples of documented hook patterns
- A post-install hook can run
git gcto clean up unreachable Git objects after package activity. - You can disable
commit.d/50vcs-committo stop automatic commits while retaining file-staging behavior. Do this only when another process creates timely, reviewable commits. - A commit hook can run
git push backupto a configured clone, creating an additional copy of the history.
Test hooks on a noncritical host first. A failing hook can delay package operations, and a push hook can transmit sensitive configuration to an incorrectly configured destination. Log the result, define who receives failures, and document how an administrator disables the hook during an incident.
A pushed repository is a backup transport, not a complete disaster-recovery plan. A usable plan also describes how to recreate the host, obtain compatible packages, restore data outside /etc, recover credentials, and test the result in an environment appropriate to the service. Periodically perform a restoration exercise rather than assuming that a successful push proves recoverability.
Choose the right operating model
etckeeper is strongest when the problem is “what changed on this machine, and how do I get back to a known state?” Larger environments need additional controls. The following comparison separates three common operating models.
| Operating model | Recovery scope | Secret-exposure controls | Audit detail | Automation burden | Rollback blast radius | Reproduce a host from scratch |
|---|---|---|---|---|---|---|
| Local-only etckeeper repository | One host while its storage is available | Local filesystem permissions; no remote copy to secure | Detailed file and metadata history on that host | Low after package hooks and daily commits are enabled | Usually limited to paths restored on that host | Limited; history does not recreate packages, data, or external dependencies by itself |
| etckeeper plus a protected private remote | One host with an additional history copy | Must secure local and remote copies, transport, identities, and retention | Local history plus remote retention and access records | Moderate; maintain push hooks, credentials, and failure monitoring | Still host-local when restoring, but a mistaken push or broad restore can affect more data | Better evidence for rebuilding a host, but still requires an image, package source, data backup, and recovery procedure |
| Configuration-management workflow paired with etckeeper | Fleet-wide desired state plus per-host history | Central secret controls are required in addition to repository protection | Change records from the management system and host-local diffs | High; requires tested definitions, credentials, rollout controls, and drift handling | Potentially fleet-wide unless staged and limited by policy | Strongest of these options when definitions, package inputs, and data-recovery steps are maintained |
For a single server, start with etckeeper and a disciplined commit and backup policy. For many hosts, keep etckeeper for forensic, host-specific history while a protected source repository and configuration-management system define the intended fleet state. Do not treat a host’s accidental edit as the authoritative configuration for every machine.
A practical operating checklist
- Install the distribution package and confirm that initialization created a repository and initial commit.
- Read
/etc/etckeeper/etckeeper.confand verify the backend instead of assuming Git. - Keep daily commits and APT hooks enabled unless an alternative schedule is written, monitored, and tested.
- Before editing, know how to run the affected service’s syntax check and health check.
- After editing, inspect a path-limited diff and commit with a reason that explains intent.
- Use log, diff, and blame to establish context before restoring anything.
- Restore only the required paths, then inspect the resulting diff and validate the service while preserving an existing administrative session.
- Protect local history and any remote clone as sensitive data; rotate credentials if old commits exposed them.
- Document hook behavior, monitor failed pushes or commits, and test restoration rather than relying on a successful backup command.
Where etckeeper’s boundary lies
etckeeper makes one machine’s evolving /etc inspectable and reversible. It does not guarantee that an older configuration works with a newer package, does not encrypt or redact secrets, and does not recreate a complete server. Its value comes from combining automatic capture with deliberate review: package hooks and daily commits preserve evidence, while human-authored commits explain operational intent. Add protected remotes, configuration management, secret controls, and tested rebuild procedures when the recovery or fleet requirements exceed one host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
