AIDE
Advanced Intrusion Detection Environment: a tool that records hashes and attributes of files and reports any that change, appear or vanish.
In more detail
aide --init builds the baseline database and aide --check compares against it; the baseline must be stored where an intruder cannot rewrite it. rkhunter adds checks for known rootkits.
Related terms
- SHA-256 — A widely used hash function that turns any data into a 256-bit fingerprint, shown as 64 hexadecimal characters.
Taught in
- What Changed Last Night? Integrity, Scans, Benchmarks And Secure Deletion — CompTIA Linux+ (XK0-006) Exam Prep