Tips and tricks: How do I check the software integrity on Red Hat Enterprise Linux 5?

There is an integrity checking software called AIDE shipped by Red Hat® Enterprise Linux® 5. AIDE provides some general strategy for implementing integrity checking to detect the intrusions when they have occurred.

To install AIDE, using following command:

# yum install aide

To configure AIDE, customize the /etc/aide.conf to meet the requirements of the system. For more detailed information about the AIDE configuration file, please refer the man page of aide.conf.

To generate a new database and install it on AIDE system:

# aide --init
# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

By default, the program will create a new file aide.db.new.gz in the /var/lib/aide/ directory. This must be installed on the system manually by using the copy command. Typically, system administrator should create an AIDE database on a new system before the system is connected to any network.

To check the inconsistencies between the current system and the AIDE database, running following command:

# aide --check

or

# aide

If the check produces any unexpected output, investigate and fix it as soon as possible.

The aide command can also be run as a crontab job to do periodic integrity checking.

Red Hat’s customer service and support teams receive technical support questions from users all over the world. Red Hat technicians add the questions and answers to Red Hat Knowledgebase on a daily basis. Access to Red Hat Knowledgebase is free. Red Hat Magazine offers a preview into the Red Hat Knowledgebase by highlighting some of the most recent entries. The information provided in this article is for your information only. The origin of this information may be internal or external to Red Hat. While Red Hat attempts to verify the validity of this information before it is posted, Red Hat makes no express or implied claims to its validity.

This entry was posted by the editorial team on Monday, April 28th, 2008 at 4:13 pm and is filed under Red Hat Enterprise Linux, tips and tricks, technical. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.