Host-Based File Integrity Monitoring with AIDE
When an adversary compromises a Linux server, they frequently alter system binaries (installing backdoored binaries like sshd or login), inject malicious cronjobs, modify web directories, or alter file permissions (e.g., granting SUID or world-writable access). AIDE (Advanced Intrusion Detection Environment) is a host-based File Integrity Monitoring (FIM) tool that builds a cryptographic baseline database of file attributes, hashes, permissions, and SELinux labels to detect file tampering. How AIDE Operates AIDE scans the filesystem according to rules defined in /etc/aide.conf, calculates cryptographic checksums (SHA-256, SHA-512) and metadata attributes for each file, and stores them in a baseline database (/var/lib/aide/aide.db.gz). ...