Use File Integrity Monitoring (FIM)

File Integrity Monitoring (FIM) ensures the security and integrity of critical system files by detecting unauthorized modifications. Attackers often modify configuration files, binaries, or logs to hide their presence, escalate privileges, or install malware.

By using FIM tools like AIDE, you can:
✅ Detect unauthorized file changes caused by malware or attackers.
✅ Identify tampering with system configurations or security logs.
✅ Ensure compliance with security policies and standards.

How to Set Up File Integrity Monitoring Using AIDE

1. Install AIDE (Advanced Intrusion Detection Environment)

For Debian/Ubuntu:

sudo apt install aide -y

For CentOS/RHEL:

sudo yum install aide -y

2. Initialize the AIDE Database

The AIDE database is a snapshot of file hashes, attributes, and permissions at a specific point in time.

sudo aideinit

• This creates the initial baseline database.

• The database is stored at:

  /var/lib/aide/aide.db.new.gz
  

• Move the initialized database to the active database location:

  sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
  

3. Run a File Integrity Check

To compare the current system state with the baseline:

sudo aide --check

• If no unauthorized changes are found, the output will confirm system integrity.

• If modifications are detected, review and investigate them immediately.

4. Automate Regular AIDE Checks Using Cron Jobs

To schedule daily integrity checks at 3:00 AM, add a cron job:

sudo crontab -e

Add the following line:

0 3 * * * /usr/bin/aide --check

(Runs AIDE every day at 3 AM and logs any changes.)

Best Practices for File Integrity Monitoring (FIM)

✅ Monitor Critical Files and Directories
Edit the AIDE configuration file to specify which files to monitor:

sudo nano /etc/aide/aide.conf

Example rule to monitor system binaries and config files:

/etc/    p
/bin/    p
/usr/bin p
/sbin/   p
/var/log p

• p → Tracks permissions, ownership, and changes to these files.

✅ Integrate FIM with Logging and Alerts

• Configure FIM to send alerts when changes are detected.

• Combine FIM with SIEM tools (e.g., Splunk, ELK, or Wazuh) for real-time monitoring.

✅ Regularly Update the AIDE Database
After legitimate updates or patches, reinitialize the database:

sudo aideinit
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

(Prevents false positives from authorized changes.)

✅ Use Other FIM Solutions for Advanced Security

• Tripwire (alternative to AIDE):

  sudo apt install tripwire
  

• Wazuh (SIEM with built-in FIM capabilities)

Why FIM is Essential for Security

🔹 Detects rootkits, malware, and unauthorized system modifications.
🔹 Helps with compliance (PCI-DSS, HIPAA, ISO 27001) by monitoring critical system files.
🔹 Provides an audit trail for forensic analysis after a security incident.

By implementing File Integrity Monitoring (FIM), you can detect suspicious changes, prevent security breaches, and maintain a hardened Linux environment.