Lesson 2.2: File integrity monitoring with AIDE
Attackers who gain root leave changes: a new account, a SUID copy of a shell, a cron entry, a dropped binary. File integrity monitoring (FIM) records what sensitive files look like (permissions, owner, size, hashes) and reports every difference later. AIDE is the standard open-source tool on Linux, and FIM is required by frameworks such as PCI DSS. In the lab, AIDE's nightly check on Northwind's web server reports differences from last week's baseline: you read the report, confirm a backdoor account, a persistence job and a SUID change, and record the findings without destroying the evidence.
17 min
You will learn to
- Explain file integrity monitoring
- Read an AIDE configuration
- Interpret aide --check output and exit codes
- Confirm findings with ordinary tools
- Handle a baseline during an incident
Key terms
- File integrity monitoring (FIM)
- Recording file attributes and hashes, then reporting changes.
- AIDE
- Advanced Intrusion Detection Environment: open-source FIM for Linux and Unix.
- Baseline
- The recorded known-good state the check compares against.
- UID 0
- The user ID that is root, whatever the account is called.
- Persistence
- Mechanisms that keep an attacker's access across reboots and password changes.
← The Windows security model · All lessons · The OWASP Top 10, and what attacks look like in a log →