AIDE File Integrity Checker
ToolAIDE (Advanced Intrusion Detection Environment) takes a fingerprint of the files and directories you care about, then tells you exactly what changed since. It hashes contents with several digest algorithms and watches file attributes too, so a swapped binary or a quietly loosened config shows up in the next check instead of the next incident. Free under the GPL and actively maintained, it is the modern stand-in for Tripwire on Linux servers.
Resources
Videos
Fortify Your Linux: Intrusion Detection with AIDE
AIDE on openSUSE Leap, start to finish in seven minutes: install it, edit the config, build the baseline database at 3:53, then run the first integrity check at 4:46. The next chapter puts that check in crontab, so it runs every night whether anyone remembers or not. File integrity monitoring sounds abstract on a slide; here it is a handful of commands and one cron line. The habit to copy is the closing update step: rebuild the baseline after every planned change, or tomorrow's report flags your own work.
More in Linux servers
- OpenSCAP Compliance Scanner
- AIDE File Integrity Checker
- Lynis Security Auditor
- SSH MFA Guide: A Second Factor on Every Server Login