Detection

If an attacker gains access to systems by working around your defenses, you need to discover the attacker’s tracks in good time, at least to mitigate the further risk of damage. We show you how to monitor changes to files with the Linux AIDE tool.

Matthias Wübbeling

Advanced Intrusion Detection Environment (AIDE) uses various techniques to detect the manipulation of files, starting with regular expressions for selecting the files to be included in the integrity checks. The files are then processed with hashing tools to generate checksums. Additionally, the associated filesystem properties, such as access rights, inodes, SELinux, Amazon Elastic File System (EFS), and other extended attributes, are also taken into account. Setup and Use To use AIDE for integrity checks, you first need to install the tool with your distribution’s package manager. AIDE is included in all the popular distributions; if your environment is not supported, you can easily download the release from the GitHub project [1]. After the install, launch AIDE directly; you will need to be root, use sudo, or launch a root shell.…

You're reading a preview of

ADMIN Network & Security (Digital) - 1 Issue, November/December 2024

DiscountMags is a licensed distributor (not a publisher) of the above content and Publication through Zinio LLC. Accordingly, we have no editorial control over the Publications. Any opinions, advice, statements, services, offers or other information or content expressed or made available by third parties, including those made in Publications offered on our website, are those of the respective author(s) or publisher(s) and not of DiscountMags. DiscountMags does not guarantee the accuracy, completeness, truthfulness, or usefulness of all or any portion of any publication or any services or offers made by third parties, nor will we be liable for any loss or damage caused by your reliance on information contained in any Publication, or your use of services offered, or your acceptance of any offers made through the Service or the Publications. For content removal requests, please contact Zinio.