Lead Image © rudall30, 123RF.com
File Integrity Checks with AIDE
Detection
Advanced Intrusion Detection Environment (AIDE) uses various techniques to detect the manipulation of files, starting with regular expressions for selecting the files to be included in the integrity checks. The files are then processed with hashing tools to generate checksums. Additionally, the associated filesystem properties, such as access rights, inodes, SELinux, Amazon Elastic File System (EFS), and other extended attributes, are also taken into account.
Setup and Use
To use AIDE for integrity checks, you first need to install the tool with your distribution's package manager. AIDE is included in all the popular distributions; if your environment is not supported, you can easily download the release from the GitHub project [1].
After the install, launch AIDE directly; you will need to be root, use sudo, or launch a root shell. Launching AIDE without passing in command-line arguments starts a check directly or complains that no database for the check exists below the path specified in the configuration. To prepare the AIDE database with the current status, trigger the database init with the command:
aide --init
In our lab, this took north of one and a half minutes for around 318,000 files. AIDE consumed virtually no resources on a CPU with 12 cores. The file /var/lib/aide/aide.db.new was created and had to be renamed aide.db for use in checks. The output will contain the checksums of the various hash procedures that are supported. Of course, you also need to keep an eye on these checksums to detect potential manipulation. Because several hashes are generated, an attacker cannot simply leverage potential vulnerabilities in individual hash functions to manipulate data without you noticing.
If you now run a check directly after creating the database,
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Manipulation detection with AFICK
AFICK is a small, free tool that helps administrators detect attempts to manipulate documents and system files. -
Discover ransomware with PowerShell
Simple backup strategies cannot protect files encrypted by ransomware, because they can be affected as well. A PowerShell script can ensure that your files are okay before sending them to backup. -
Security analysis with Microsoft Advanced Threat Analytics
Classic security safeguards, like antivirus and firewall products, are imperative for system protection. To search proactively for network intruders, as well, Microsoft offers Advanced Threat Analytics – a tool that will help even less experienced admins. -
Open source forensics for adaptive detection of threats on CRITIS networks
The open source tool Velociraptor is at the heart of a solution that automatically detects cyber threats in industrial environments, offering a defensive strategy and protecting critical infrastructures. -
Security issues when dealing with Docker images
Although developers appreciate Docker's ease of use and flexibility, many admins are worried about vulnerabilities. We look at various approaches to securing container images and the price to be paid.
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
