AIDE:
AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker
It creates a database from the regular expression rules that it finds from the config file(s). Once this database is
Installation Procedure:
1. Install AIDE package on CentOS/RHEL:
# yum install -y aide
2. Check and adjust aide configuration file to fulfill your needs:
# vim /etc/aide. conf
3. Initialize AIDE database - it will scan all the files in folders that were included in the config file and save their hash as well as attributes info
Once initialized we may see below line
### AIDE database at /var/lib/aide/aide. db . new . gz initialized.
4. we need to modify newly created database with mv command
5. Check the database before making any changes
6. Make any changes Ex : touch /usr/sbin/mytestfile.txt( just relating any file to test)
7. You may consider keeping golden copy of AIDE database (default is set to /var/lib/aide/aide. db . gz ) is secure and read-only location. It will allow you to compare current system integrity to the golden copy.
To check what changed run:
# aide -C
A popular host-based intrusion detection system on Linux is tripwire . This software can keep track of many different filesystem data points in order to detect whether unauthorized changes have occurred.
In this article, we will discuss how to install and configure tripwire and Commands for installation
Install Tripwire.
# yum install tripwire -y
Creating site and local keyfile pass-phrases
# tripwire -setup-keyfiles
Initializing Tripwire Database
# tripwire --init
Modifying Tripwire policy file
# vi /etc /tripwire /twpol.txt
Once modifying all the files, update the tripwire policy file.
# tripwire --update-policy --secure-mode low /etc/tripwire /twpol.txt
Checking for any changes in files/directories
# tripwire --check --interactive
It will ask you to enter passwords
Now let us add a new file called Anil.
# touch Anil
Now check this file with tripwire ? check ? interactive command. You may find the file Anil under the Added section in the result
# tripwire --check --interactive
OR
# tripwire --check
It will not ask you to enter password
Viewing the tripwire report file
All tripwire report files having extension . twr are stored in /var/lib/tripwire /report/ directory. These are not text files, so you can? t view them using any editor. First convert them using the following command to human readable format.
# twprint --print-report --twrfile /var/lib/tripwire/report/server.ostechnix.com-20130510-124159.twr > /tmp/twrreport.txt
Now open the file using any editor.
# vi /tmp/twrreport.txt
Viewing tripwire configuration and policy file locations
To view the policy file locations enter the following command.
#twadmin --print-polfile
To view the configuration files enter the following command.
# twadmin --print-cfgfile
Scheduling Tripwire Check
You may find a cron file tripwire -check might be created automatically in the /etc/cron . daily/ directory. If it isn ? t created, open your crontab file and add lines as shown below. The following example will execute the tripwire daily at 5 am.
# vi /etc/crontab
# Tripwire Monitor process
00 5 * * * /usr/sbin/tripwire --check
OR
0 7 * * * /usr/sbin/tripwire --check > /mnt/tripwire
0 8 * * * /bin/mail -s "Tripwire" amullapudi@ciphercloud.com < /tmp/tripwire
It will check system at 7 AM of everyday, everyweek , every month, every year and it will send an email on same .
========================================================================
Hi friends in this article we shall talk about Linux operating system file system(Directory Structure). File system in Linux is categorized based on the based on nature of files or
directories.
Files are categorized into following types:
| /bin | user binaries |
| /sbin | system binaries |
| /etc | configuration files |
| /dev | device files |
| /proc | process files |
| /var | variable files |
| /tmp | temporary files |
| /usr | user programs |
| /home | home directory |
| /boot | boot loader files |
| /lib | library files |
| /opt | optional-add-on apps |
| /mnt | mount directory |
| /media | removable devices |
| /sv |
service data |
In Linux operating system "/" represents root directory which means it is a parent directory for Linux file system.
/bin: This directory contains binary executable s, Common Linux commands you need
to use in single-user modes are located under this directory.
Ex :
/sbin: This directory contains binary executable s, But the linux commands located
under this directory are used typically by system administrator for system
maintenance purpose.
Ex :
/etc: This directory contains configuration files required by all programs ,This also
contains startup and shutdown shell scripts used to start/stop individual programs.
/Ex :
/dev: This directory contains device files and also contains files for handling removable
devices.
/Ex :
/proc: This directory Contains information about system.This is a pseudo filesystem
process contains information about running process.
/Ex :
/var: Variable means it contains variable length records. which means Content of the files that are expected to grow can be found under this directory.
/Ex :
/tmp: Directory that contains temporary files created by system and users.Files under
this are get deleted when system rebooted.
/user: Contains binaries, libraries, documentation, and source-code for second level
programs. It has also sub directories like bellow image.
/home: Home directories for all users to store their personal files.
/boot: Contains boot loader related files like bellow image.
/lib : Contains library files that supports the binaries located under /bin and /sbin
/opt : opt stands for optional,Contains add-on applications from individual vendors.
/mnt : Temporary mount directory where sysadmins can mount filesystems.
/media : Temporary mount directory for removable devices.
/srv: srv stands for service Contains server specific services related data.
Que:Do you want to learn Linux or Any But Do not willing to install that , Still you can
explore any operating system?
Sol :Yes,You can,Use Visualization Software's.
Popular Solutions: Oracle Virtual Box , VMWARE.
Oracle Virtual Box:[oracle.com]
VirtualBox is powerful Cross-platform Virtualization Software for x86-based systems.
"Cross-platform" means that it installs on Windows, Linux, Mac OS X and Solaris x86 computers. And "Virtualization Software" means that you can create and run multiple
Virtual Machines, running different operating systems, on the same computer at the
same time. For example, you can run Windows and Linux on your Mac, run Linux and
Solaris on your Windows PC, or run Windows on you Linux systems.Oracle VM VirtualBox
is available as Open Source or pre-built Binaries for Windows, Linux, Mac OS X and Solaris.
To day i will guide you to install oracle virtual box in windows operating system
Requirements:
1. Oracle Virtual Box Download from oracle.com.
2.Operating system image file of your choice.
My choice Backtrack Linux:
Procedure to Install:
Step 1:Download and install Oracle Virtual Box from oracle.com and open it.
Step 2: Click on New option to configure options.
2.1.Give OS name and type of OS and its version name of your choice.
2.2.Select Memory size i suggest +1 GB.
2.3.Select Create a virtual hard drive under Hard Drive.
2.4.Click create to proceed.
Step 3:Configure virtual box to OS disk image.
Step 4:Click on create option and locate image file
4.1.Click on file explorer icon.
Step 5: After this start Virtual Box
5.1.Select and click on start option.
5.2.Wait a while and it automatically begins
Step 6: For me its Backtrack Linux.
Step 7: That's it your done! Your comments are valuable.