CompTIA Linux+ (XK0-006)SecurityEasy
A security auditor needs to verify the integrity of the 'passwd' database on a Linux system by comparing its current state against a previously established baseline. Which command, along with its appropriate options, would most effectively perform this check using AIDE?
- Aaide --init
- Baide --compare
- Caide --check
- Daide --update
Show answer & explanationAnswer & explanation
Correct answer: C. aide --check
The 'aide --check' command is specifically designed to compare the current state of files against the previously initialized AIDE database, reporting any modifications, additions, or deletions. This is the primary command for performing integrity verification.
Why the other options are wrong
- A. aide --init creates the initial AIDE database; it does not check for changes.
- B. aide --compare is not a standard AIDE command for integrity verification; 'aide --check' is used for this purpose.
- D. aide --update updates the baseline database to reflect the current system state, effectively accepting changes.
AIDE --check
The 'aide --check' command is used to perform an integrity check of the file system by comparing the current state of files against the previously generated AIDE database.
- It reports any changes (modification, addition, deletion) since the last database update.
- Requires a pre-existing AIDE database (created with 'aide --init').
- Often run as part of a scheduled task (e.g., cron job) for regular monitoring.
Memory trick: AIDE's Init starts, Check verifies, Update accepts changes.