(which would be stored below
/etc
like any configuration change should be). It also lists multiple
configuration files (identified by the “c” letter on the second field) that had been legitimately
modified.
Monitoring Files: AIDE
The Advanced Intrusion Detection Environment (AIDE) tool checks file integrity and detects any
change against a previously-recorded image of the valid system. The image is stored as a database
(
/var/lib/aide/aide.db
) containing the relevant information on all files of the system (finger-
prints, permissions, timestamps, and so on).
You can install AIDE by running
apt update
followed by
apt install aide
. You will first initial-
ize the database with
aideinit
; it will then run daily (via the
/etc/cron.daily/aide
script) to
check that nothing relevant changed. When changes are detected, AIDE records them in log files
(
/var/log/aide/*.log
) and sends its findings to the administrator by email.
