We present an IDS Installation and Configuration Tutorial on Linux Ubuntu. AIDE is also known as a HIDS that acts very well to check the safety of your critical files.
What is AIDE?
AIDE (Advanced Intrian Detection Environment) is a host-based intrusion detection system (HIDS) that acts as a “digital watchman” for your critical files.
AIDE creates a unique fingerprint of your system and warns of any unauthorized modification, from permissions changes to system binary tampering.
Installing Aide on Ubuntu
To install AIDE on Ubuntu, let’s use the command below.
sudo apt install aide -y
Then will appear the option to install Postfix. Postfix can be used by AIDE to send alert notification emails. Below is a suggestion of steps in postfix.
In this case, we will not configure Postfix because in this tutorial we will not send alert emails. If you want to correctly configure Postfix, you can use this tutorial: Postfix Tutorial.
AIDE INITIAL CONFIGURATION
Now that we have installed, we can start to configure AID. For this, we will edit the AIDA configuration file that is on the way “/etc/aide/aide.conf”.
Let’s use the command below to edit the AIDE configuration file.
sudo nano /etc/aide/aide.conf
In this file we can add folders that we want to monitor or delete folders from a monitoring by AIDE.
As an example, let’s imagine that I don’t want AIDE not to monitor the “/snap/firefox/common” directory of each user on my machine. For this, I would add the line below at the end of the “aide.conf” file.
!/home/[^/]+/snap/firefox/common
This line starts with the symbol “!” which indicates that we will deny monitoring to the specified directory.
The line “/home/[^/]+/snap/firefox/common” Indicates every directory “/snap/firefox/common/” that is within all users “/[^/]+” that are inside the directory “/home“.
We could have used another example as “!/var/log” and we would deny the monitoring of the directory “log” which is inside the directory “var“.
Initializing the AIDE database
To initialize the AIDE database and start generating hash of files, let’s use the command below.
sudo aideinit --force --config /etc/aide/aide.conf
Depending on your machine this may take a long time. Go get a snack.
In this case, we are ensuring that AIDE use the configuration file that is in “/etc/aide/aide.conf“.
If you want you can check the database files that were created with the command below.
sudo ls -alh /var/lib/aide/
Testing AIDE with a suspicious file
Now, let’s create a suspicious file within “/usr/bin/”.
In this case, we are simulating that someone has had access to the machine and inserted a suspicious file called “bad_file” within the directory “/usr/bin/”.
To create a suspicious file within “/usr/bin/” Let’s use the command below.
sudo touch /usr/bin/bad_file
Check with AIDE
Now, let’s run the AIDE check and see if it detects that we enter a suspicious file in “/usr/bin/”.
To perform the AIDE check we will use the command below.
sudo aide --check --config /etc/aide/aide.conf
Below we can see in the figure that the suspect file was detected and generated a warning showing the path and name of the file.
Updating the AIDE database
After a legitimate change in your files it is interesting to update the AIDE database. For this, let’s use the command below.
sudo aide --update --config /etc/aide/aide.conf
Why do you need Aide?
- Proactive security
Detects backdoors, rootkits and malicious changes in time – before invaders cause greater damage. - Integrity Monitoring
Alert about:
Changes in sensitive file permissions (/etc/sudoers,/bin)
System Binaries (/USR/Bin,/sbin) modifications
Suspected file addition/removal - CONFORMITY AND AUDIT
Generates essential forensic reports for:
Meet Safety Standards
Infrastructure Audits
Post-ending investigation
See more:
Why use Kali Linux inside VirtualBox?
How to Install Kali Linux on VirtualBox: Step-by-Step Guide for Beginners
Tutorial: How to use WHOIS and RDAP
Tutorial how to Install and configure VNC on Ubuntu
Python get metadata from images and pdfs
https://askubuntu.com/questions/1507027/how-install-aide-on-ubuntu
Juliana Mascarenhas
Data Scientist and Master in Computer Modeling by LNCC.
Computer Engineer
