Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 171 / 450

aide --check -V
AIDE found differences between database and filesystem!!
Start timestamp: 2009-02-18 15:14:10
Summary:
Total number of files: 1992
Added files: 0
Removed files: 0
Changed files: 1
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /etc/passwd
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
File: /etc/passwd
Mtime : 2009-02-18 15:11:02 , 2009-02-18 15:11:47
Ctime : 2009-02-18 15:11:02 , 2009-02-18 15:11:47
In this example, the file
/etc/passwd
was touched to demonstrate the effect.
13.3 System Independent Checking
For the paranoid administrator, and of course this is all about paranoia, it is advisable
to also run the AIDE binary from a trusted source. This excludes the risk, that some
attacker also modified the aide binary to hide his traces.
To accomplish this task, aide must be run from a rescue system, that is independent
from the installed system. With SUSE Linux it is relatively easy to extend the rescue
system with arbitrary programs and thus add the needed functionality.
Before you can start using the rescue system, you need to provide two packages to the
system. These are included with the same syntax as you would add a driver update disk
to the system. For a detailed description about the possibilities of linuxrc, that are used
for this purpose, see
http://en.opensuse.org/Linuxrc
. In the following,
one possibility to accomplish this task is discussed.
Intrusion Detection with AIDE 157