Ensuring the integrity of your operating system and critical applications is a fundamental aspect of cybersecurity. File integrity monitoring (FIM) tools play a crucial role in detecting unauthorized changes to files and directories. In the Linux ecosystem, AIDE (Advanced Intrusion Detection Environment) stands out as a reliable open-source solution for FIM. This blog post will guide you through the installation, configuration, and utilization of AIDE on a Linux system.
- Installation:
- Configuration:
- Initialization:
- Test Configuration:
- Updating the Database:
- Final Thoughts:
Installation:
To get started, install the AIDE package using the package manager:
sudo dnf install aide -y
On older versions of Red Hat, it’s advisable to disable prelinking to prevent false positives. Modify the prelink configuration:
sudo vi /etc/sysconfig/prelink
Set PRELINKING to no:
PRELINKING=no
Configuration:
AIDE’s configuration file is located at /etc/aide.conf. This file allows you to define rules for checking permissions, ownership, timestamps, and more. Customize the configuration based on your specific environment.
sudo vi /etc/aide.conf
Initialization:
Generate the initial database for your system:
sudo aide --init
After the database is created (stored in /var/lib/aide/aide.db.new.gz), rename and remove the ‘new’ string:
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
Test Configuration:
Before checking for system changes, simulate alterations by adding a new user and modifying a binary file:
sudo useradd test
sudo passwd test
sudo rm /usr/bin/sudo
sudo mv /root/fakesudo /usr/bin/sudo
Perform an integrity check to identify changes:
aide --check
Review the detailed output to ensure that AIDE detected the modifications.
Updating the Database:
After verifying legitimate changes, update AIDE to create a new database:
aide --update
Replace the old configuration with the updated database:
mv /var/lib/aide/aide.db.gz /var/lib/aide/aide.db.gz-24APR21
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
Final Thoughts:
Automate the monitoring process using cron and consider offloading and centralizing database files for enhanced security.
You may include the sudo aide --check command into a cron job and push it to a log file to keep track of the ongoing changes to the system.
Example : sudo aide --check >> /opt/log/aidechecks.log
By implementing AIDE as part of your security strategy, you fortify your Linux system against unauthorized changes, providing an additional layer of defense in the ever-evolving landscape of cybersecurity.
📝 For more information about RHEL9 AIDE, refer to this Red Hat Customer Portal Article!
