This video is about malware detection and vulnerability scanning.
So you need to understand why Linux is not sensitive to virus.
Well the design of Linux operating system makes it less sensitive to virus.
And that is because, first, Linux has a strict separation between users and root.
And processes run with limited privileges by default.
So the access of a potential virus to the operating system by this alone is dramatically
limited.
What also helps is that files have strict ownership and permissions.
And not everything is allowed on a file.
So for a virus it's almost impossible to modify files on the operating system.
And also the source code behind Linux is open.
It's what we call the many eyeballs effect.
Everybody can read the source code and everybody can detect if something is fundamentally wrong
in the source code.
So secretly sneaking a virus into source code into a program that you run on a computer
is just not done on Linux.
What also helps is that packages are installed from trusted repositories.
So your distribution comes with a repository.
The repository is signed with GPG keys.
So if anyone is pretending to be your repository, normally it doesn't get through the GPG key
check.
And all of that makes Linux a reliable platform.
Now zero-day exploits may exist.
And they make applications running on Linux potentially vulnerable.
And that is why every now and then you should be checking if anything is wrong.
Because on Linux you can have what we call a rootkit.
So rootkits are providing application backdoors that allows the root user to access secretly.
And in order to scan for rootkits, there are commonly used programs like RKHunter and CheckRootkit.
Alternatively, you can use aid for unexpected file changes.
So aid is a commonly used utility.
It works with a database that has been generated with aid minus minus init to summarize the
current state of files.
And after generating, aid creates a tar.gz.new file.
And this file must be moved to a plain tar.gz file to be used as the aid file.
This will be your blueprint and this will be what you are going to check upon.
And to detect if files have changed, the database that aid has created needs to be compared
to the current state of the file system as reported by aid minus minus check.
The aid.conf is a configuration file that is used to specify what exactly to look for
and it can be used to exclude files as well.
And aid will find changes.
It won't find what has triggered the change though.
If you also want to figure out what has triggered the change, then you should create an audit
watch rule as discussed elsewhere in this course.
Let's have a look at aid.
So let's do a sudo dnf install minus y aid.
As on most systems, it's not installed by default.
As you can see, it's not a big install.
Then sudo aid minus minus init.
And that's going to scan your file system.
Depending on the size of your file system, it might take a little bit.
So what do we see?
We see that the new aid database has been written to varlib 8.8.db.new.gz.
And that is what you are going to use to compare it against.
So let me sudo mv varlib 8.8.db.new.gz to varlib 8.8.db.gz.
Good.
Now I can use my aid check.
Let's not forget to do that with sudo aid minus minus check.
Small typo.
And that is going to check if anything has changed on the file system.
Now obviously, I just run it.
So I might as well stop it and investigate what is going on.
sudo vim on etc aid.conf is the configuration file that is used in the background.
And this is telling you what exactly is going to happen.
It includes the default rules.
And here we can see on the lower part of the screen what the default rules are.
So you know what?
I'm going to do something that should be detected.
I'm going to use sudo chmod 777 on etc motd.
That's a file that really nobody cares about.
But now we can check if aid is going to find out that the change has occurred.
So here you can see the report.
And in the report, we have a changed entry.
And in the changed entry, we see exactly what has happened.
So this on the left side is what it has found before.
And on the right side is the changed file.
And that allows you to use aid as a very convenient utility
to detect for unexpected file changes.
It's recommended to use it to ensure the security of your system.