Having anti-virus software and a rigorous firewall as your first line of defense is considered a bare necessity nowadays. But what happens when somehow the malicious code or intent somehow gets past your protection? That is where an Intrusion Detection System (IDS) comes into play.<\/p>\n
AIDE<\/a> is one such tool among others (like Tripwire<\/a>) – it builds an initial local database of the files you specify it to monitor using the verification and checksum methods you set, after which if you run a check against this database AIDE will show you what files have been changed since the build of the database. Essentially, when you run it periodically you’ll be able to tell what, when and how has been changed since the last check had been run.<\/p>\n First, let’s install the base package:<\/p>\n Now using your editor of choice we should define some basic configuration for aide:<\/p>\n As per usual you should change everything to your liking, but now this – you can never be too paranoid and security always comes with a trade-off at comfort. For demonstrational purposes the checksums used here provide an acceptable ratio of calculation speed\/efficiency, however, in a production environement a more robust checksum combination is preferred.<\/p>\n Example contents of aide.conf<\/b>:<\/p>\n Finally, you can include the directories to be monitored at the end of this config file, so for instance should you only want to keep an eye on your www<\/b> folder, then this is what you should put at the end of aide.conf<\/b>:<\/p>\n Now we have to build the initial database by running:<\/p>\n Also don’t forget to set your email address over here:<\/p>\n After that we are good to go! To test it, create a file using for example, touch \/var\/www\/test.txt<\/b> and do a manual check by using:<\/p>\n A cron job is added automagically to the cron.daily<\/b> jobs.<\/p>\n","protected":false},"excerpt":{"rendered":" Having anti-virus software and a rigorous firewall as your first line of defense is considered a bare necessity nowadays. But what happens when somehow the malicious code or intent somehow gets past your protection? That is where an Intrusion Detection System (IDS) comes into play. AIDE is one such tool among others (like Tripwire) – […]<\/p>\n","protected":false},"author":1,"featured_media":235,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,7],"tags":[],"_links":{"self":[{"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/posts\/234"}],"collection":[{"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/comments?post=234"}],"version-history":[{"count":2,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/posts\/234\/revisions"}],"predecessor-version":[{"id":237,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/posts\/234\/revisions\/237"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/media\/235"}],"wp:attachment":[{"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/media?parent=234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/categories?post=234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.gaborhargitai.hu\/wp-json\/wp\/v2\/tags?post=234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}apt-get install aide<\/code><\/p>\nnano \/etc\/aide\/aide.conf<\/code><\/p>\ndatabase=file:\/var\/lib\/aide\/aide.db
\ndatabase_out=file:\/var\/lib\/aide\/aide.db.old
\ndatabase_new=file:\/var\/lib\/aide\/aide.db.new
\ngzip_dbout=yes
\nChecksums = sha512+crc32
\ndatabase_attrs = Checksums
\n<\/code><\/p>\n\/var\/www Full<\/code><\/p>\naideinit<\/code><\/p>\nnano \/etc\/default\/aide<\/code><\/p>\naide -c \/etc\/aide\/aide.conf --check<\/code><\/p>\n