Install etckeeper from your Linux distribution, let it initialize /etc, and use its configured version-control system to review, attribute, and reverse configuration changes. On Ubuntu and Debian, sudo apt install etckeeper normally creates the repository and an initial commit automatically. Make explicit commits after important edits, retain the package-manager and daily hooks for coverage, and treat every copy of the repository as sensitive because /etc can contain passwords, private keys, and security policy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What etckeeper actually manages
/etc is the live configuration tree for a Linux host. A normal Git repository can show text changes, but it does not by itself preserve all of the file metadata that matters to system configuration. etckeeper adds that operating-system awareness and connects version-control operations with package-manager activity.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
- Host-local history: it records how one machine’s configuration evolves, so you can identify a change, inspect its author and message, and recover an earlier file state.
- Metadata preservation: the upstream project documents tracking metadata such as permissions that ordinary Git does not normally support. This is important for files such as
/etc/shadow, where ownership and mode are security controls. - Automatic coverage: package hooks commit around package installation, and Ubuntu’s default setup makes a daily commit of otherwise uncommitted changes.
- Not fleet management: it does not replace a configuration-management system, a secret manager, or a disaster-recovery plan. It describes one host’s state rather than defining and reproducing an entire fleet.
The repository can expose credentials, keys, certificates, account databases, and network policy. Restrict local permissions and use an access-controlled, encrypted transport or private remote if you copy it elsewhere. Version control records content; it does not automatically redact secrets or encrypt a remote.
Install etckeeper on Ubuntu or Debian
Use the distribution package rather than downloading an unrelated copy:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Refresh package metadata:
sudo apt update. - Install the package:
sudo apt install etckeeper. - Open
/etc/etckeeper/etckeeper.confand verify the configured backend. Ubuntu documents Git as the default VCS. - Check the working tree and recent history from the configured repository:
sudo etckeeper vcs status
sudo etckeeper vcs log --oneline --decorate -n 10The vcs subcommand runs the configured version-control command in /etc, so these checks continue to work if an administrator selects a supported backend other than Git.
What installation initializes
Ubuntu states that package installation automatically initializes the /etc repository and creates an initial commit. That first snapshot gives you a baseline against which later edits and package changes can be compared. If you intentionally need to remove the initialization, Ubuntu documents:
sudo etckeeper uninitDo not run uninit as a routine cleanup step: it removes the version-control setup that provides your history.
Initial verification checklist
sudo etckeeper vcs statusreturns the state of/etcrather than an error about a missing repository.sudo etckeeper vcs log --oneline --decorate -n 10shows an initial commit./etc/etckeeper/etckeeper.confidentifies the backend you intend to use.- The repository directory and its contents are readable only by appropriately trusted administrators.
Record a deliberate configuration change
Automatic commits are useful safety net, but a meaningful administrative change deserves a descriptive, immediate commit. This creates a reviewable boundary instead of leaving several unrelated edits to be bundled into a later daily snapshot.
- Edit the file with your normal administrative tool. For example:
sudoedit /etc/ssh/sshd_config. - Inspect exactly what changed before recording it:
sudo etckeeper vcs diff -- /etc/ssh/sshd_config- If the diff is correct, commit all current
/etcchanges with a reason:
sudo etckeeper commit "Harden SSH authentication settings"The etckeeper manpage describes this command as committing all /etc changes. When sudo or su was used to become root, it also records the original username, allowing an administrator to distinguish the person who initiated the operation from the root account used to write the files.
Because the commit covers the whole tree, check sudo etckeeper vcs status first if other administrators or automation may have uncommitted work. If unrelated edits are present, decide whether they belong in the same operational change or should be handled separately according to your backend’s staging workflow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How package upgrades and daily commits appear
Package-manager hooks
Ubuntu documents commits before and after package installation. Consequently, an upgrade that changes a daemon’s defaults, creates a new configuration file, or modifies a maintainer-managed file becomes visible in the /etc history. The documented demonstration is:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo apt install postfixAfter that transaction, inspect the log and diff to see the package’s configuration changes alongside the hook-created commits. This is especially valuable when a service behaves differently after an upgrade: the history can show whether a package, a local administrator, or both touched the relevant file.
Daily automatic commits
Ubuntu’s default configuration also makes a daily commit of uncommitted /etc changes. This catches edits made by scripts, installers, or administrators who did not make an explicit commit. The setting AVOID_DAILY_AUTOCOMMITS disables that behavior. Leave automatic coverage enabled unless your operating procedure supplies another dependable schedule and records equivalent attribution.
Daily commits are not a substitute for a useful message. Use an explicit commit immediately after a planned change; regard the daily snapshot as a backstop for changes whose exact timing or operator may otherwise be difficult to establish.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFind out what changed, when, and by whom
Always inspect history before restoring anything. A rollback writes into the live configuration tree; choosing the wrong commit can disable a service or reintroduce a known vulnerability.
History for a service or directory
sudo etckeeper vcs log -- /etc/nginxLimit the log to the relevant path, then read commit messages and timestamps. If the path was renamed or moved, broaden the query to its parent directory and inspect the surrounding commits.
Compare two states
sudo etckeeper vcs diff HEAD~1..HEAD -- /etc/nginxThis compares the current commit with its parent for the selected path. Replace the revisions with the commits you need to compare; for a package transaction, use the commits immediately before and after the transaction shown in the log.
Attribute individual lines
sudo etckeeper vcs blame /etc/ssh/sshd_configBlame associates each line with the commit that last changed it. Use it as an investigation aid, not as proof that the named person designed the entire setting: generated files, automated package hooks, and broad commits can legitimately be the last writer.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Roll back a bad change without guessing
Restoring a file from version control changes the live configuration immediately. Perform the following sequence during an approved maintenance window when the affected service is critical.
- Identify the target revision. Use the path-specific log and a diff to select the last known-good commit. Confirm that the revision contains the correct version of every file you plan to restore.
- Preserve the current state. Save or commit the present files before replacing them, unless they contain an active incident response change that must remain outside normal history. This gives you a way to inspect or reapply the current state.
- Restore with the configured backend. Run the backend’s checkout or restore operation from
/etc, specifying paths relative to that tree where the backend requires it. With a Git backend, the form is:
cd /etc
sudo etckeeper vcs checkout <known-good-commit> -- path/inside/etcReplace <known-good-commit> and path/inside/etc with real values. If your configured VCS uses a different restore syntax, use that backend’s command through etckeeper vcs; do not assume Git options apply to every backend.
- Review the resulting diff. Run
sudo etckeeper vcs diffand verify that only the intended files and metadata changed. Check ownership, permissions, included files, and any generated configuration that depends on the restored file. - Validate the service. Use the service’s own configuration-test command, then check its status and logs. A syntactically valid file can still reference a missing certificate, socket, user, or upstream.
- Commit the recovery. Once the service is healthy, create a message such as
Restore SSH configuration after failed authentication change. The commit should explain why the rollback occurred, not merely repeat the filename.
If validation fails, do not repeatedly check out older revisions. Restore the preserved state or correct the specific dependency, inspect the new diff, and involve the service owner. etckeeper supplies history and VCS access; it cannot determine whether a rollback is safe for the current runtime state.
Metadata, permissions, and security boundaries
Configuration content is only one part of a secure system. A mode change on an authentication database or a key file can be as consequential as a changed line. The upstream project specifically calls out metadata tracking, including permissions that ordinary Git does not normally preserve. Review mode and ownership after restores and after package operations, especially for:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- credential and account databases such as
/etc/shadow; - private keys, certificate stores, and files read by a single daemon account;
- sudo, SSH, PAM, firewall, and service-policy files whose permissions control who may alter them.
Do not treat a commit as a sanitised record. A private remote, encrypted transport, and strict access policy are administrative controls you must provide. Audit who can read the repository, who can push to a remote, and how access is revoked when a host or administrator is decommissioned.
Hooks, maintenance, and remote copies
The upstream project runs executable hook files in /etc/etckeeper/$command.d/. Hooks let you add maintenance or backup behavior without replacing the package’s core workflow.
- A documented post-install example runs
git gcto maintain a Git repository after installation activity. - You can disable
commit.d/50vcs-committo stop automatic commits while retaining file-staging behavior. If you do this, document the replacement schedule; otherwise uncommitted changes can accumulate unnoticed. - A documented commit hook runs
git push backupto a configured clone. This can copy history to a protected remote after commits.
Test hooks as code. Confirm that a failed remote is reported, that a package transaction does not hang waiting for network access, and that the destination cannot be modified by untrusted users. A push is a backup transport, not a complete disaster-recovery plan: document how to rebuild the host, protect the remote, and test restoration in an environment suitable for the service.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Troubleshoot common etckeeper situations
The status command says the repository is missing
First verify that you are invoking etckeeper with administrative privileges and that /etc/etckeeper/etckeeper.conf exists. A successful package installation on Ubuntu or Debian should have initialized the tree. If initialization was deliberately removed with etckeeper uninit, reinstalling or following the distribution’s initialization procedure is preferable to creating an unrelated repository by hand, because the package hooks depend on etckeeper’s setup.
The status output contains unexpected files
Do not commit blindly. Inspect the diff and identify whether the files came from a package transaction, a scheduled job, or another administrator. Since etckeeper commit covers all of /etc, unrelated work can otherwise be folded into a misleading change record. Coordinate with the owner or use the backend’s staging facilities when your operating procedure requires separate commits.
A package upgrade produced several commits
This is expected when hooks record the state before and after package installation. Read the adjacent commit messages and compare the two states rather than treating each commit as an independent manual edit. The sequence can distinguish a pre-upgrade baseline, package-written files, and subsequent local adjustments.
Automatic commits were disabled
Check whether AVOID_DAILY_AUTOCOMMITS was enabled or commit.d/50vcs-commit was disabled. Re-enable the documented defaults unless a monitored replacement process exists. A repository that silently accumulates uncommitted changes weakens both attribution and recovery.
A remote push fails
Keep the local commit: a failed push does not erase it. Record the failure, repair the protected destination or connectivity, and retry according to your backup procedure. Verify the remote’s permissions and restoration process separately; successful transport alone does not prove that a replacement host can be rebuilt.
Choose the right operating model
| Model | Recovery scope | Secret exposure controls | Audit detail | Automation burden | Rollback blast radius | Rebuild capability |
|---|---|---|---|---|---|---|
| Local etckeeper repository only | One host whose disk and repository remain available | Local filesystem permissions; no automatic encryption or redaction | Detailed per-host commits, diffs, and metadata | Low after package and daily hooks are enabled | Usually limited to selected files, but restores live configuration | Limited; it records history but does not provision a replacement host |
| etckeeper plus a pushed private remote | One host, with history recoverable if the local disk is lost | Requires private access control, encryption in transit and at rest, and secret-handling policy | Local detail plus an off-host copy | Moderate: protect the remote and test hook failures and restores | Same file-level risk on the host; remote copies increase the number of places to secure | Better evidence for rebuilding, but still requires documented host recreation |
| Configuration-management workflow paired with etckeeper | Fleet-wide desired state plus host-local history | Central secret-management and repository controls can be applied, but generated files still need care | Change review and rollout records in the management system, with etckeeper’s local attribution | Highest: define desired state, test, stage, and monitor deployments | Potentially fleet-wide if a bad declaration is rolled out; use staged deployment | Strongest option for reproducing hosts from source-controlled definitions |
For a single server, local etckeeper may be enough to answer “what changed?” and recover from an accidental edit. Add a protected remote when loss of the host would otherwise destroy the only history. For many hosts or repeatable rebuilds, pair host-local etckeeper with a protected source repository and a configuration-management tool rather than trying to turn /etc history into a fleet specification.
Operational checklist
- Install the distribution package and verify the backend in
/etc/etckeeper/etckeeper.conf. - Confirm that initialization produced an initial commit.
- Keep daily commits and package-manager hooks enabled unless an equivalent process is documented and monitored.
- Make explicit, descriptive commits for planned changes.
- Review status and diffs before every commit and before every restore.
- Use path-limited log, diff, and blame commands to investigate ownership and timing.
- Preserve the current state before a rollback and validate the affected service afterward.
- Protect local repositories and every remote copy as confidential system data.
- Test hook behavior, remote failure handling, host rebuild procedures, and restoration rather than assuming a successful push proves recoverability.
Frequently Asked Questions
How do I put /etc under version control?
On Ubuntu or Debian, run sudo apt update followed by sudo apt install etckeeper. Installation normally initializes the repository and creates an initial commit. Verify it with sudo etckeeper vcs status and sudo etckeeper vcs log --oneline --decorate -n 10.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
How do I see who changed a configuration file?
Use a path-limited log to inspect commits and messages, then sudo etckeeper vcs blame /etc/path/to/file to associate lines with their last changing commit. etckeeper can record the original username when sudo or su was used to become root, but generated files and package hooks may still be the last writer.
How do package upgrades show up in the history?
Ubuntu’s package hooks commit before and after package installation. An upgrade that changes files under /etc therefore appears in adjacent hook-created commits. Compare those revisions to separate package changes from later administrator edits.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I undo a bad configuration change safely?
Inspect the path-specific log and diff first, preserve or commit the current state, restore only the intended paths with the configured VCS, review the resulting diff and metadata, and run the service’s configuration test, status check, and log review. Commit the recovery after validation; a checkout changes live files and is not automatically safe for every service.
Does etckeeper protect passwords and private keys?
It tracks configuration and relevant metadata; it does not redact secrets or encrypt the repository. Restrict local permissions and use a private, access-controlled remote with encryption in transit and at rest when copying history.
Is etckeeper enough for several servers?
It provides useful host-local audit and recovery, but it does not define fleet-wide desired state or reproduce hosts. For multiple systems, pair etckeeper with a protected source repository, configuration-management workflow, and appropriate secret-management controls.
The Bottom Line
etckeeper gives one Linux host a practical, metadata-aware history for /etc. Install the distribution package, verify the initial commit, make descriptive manual commits, retain package and daily hooks, and inspect every diff before restoring live files. Protect local and remote copies as sensitive data, and add configuration management when you need fleet-wide reproducibility.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
