AIDE:

AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker

It creates a database from the regular expression rules that it finds from the config file(s). Once this database is initialized it can be used to verify the integrity of the files. It has several message digest algorithms (see below) that are used to check the integrity of the file. All of the usual file attributes can also be checked for inconsistencies.

Installation Procedure:

1. Install AIDE package on CentOS/RHEL:
# yum install -y aide

2. Check and adjust aide configuration file to fulfill your needs:
# vim /etc/aide.conf

3. Initialize AIDE database - it will scan all the files in folders that were included in the config file and save their hash as well as attributes info
aide --init

Once initialized we may see below line
### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

4. we need to modify newly created database with mv command
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz


5. Check the database before making any changes
aide --check

6. Make any changes Ex : touch /usr/sbin/mytestfile.txt(just relating any file to test)
again check aide database fro notify changes by running below command
aide --check


7. You may consider keeping golden copy of AIDE database (default is set to /var/lib/aide/aide.db.gz) is secure and read-only location. It will allow you to compare current system integrity to the golden copy.
To check what changed run:
# aide -C



A popular host-based intrusion detection system on Linux is tripwire. This software can keep track of many different filesystem data points in order to detect whether unauthorized changes have occurred.

In this article, we will discuss how to install and configure tripwire and Commands for installation


Install Tripwire.
# yum install tripwire -y

Creating site and local keyfile pass-phrases
# tripwire-setup-keyfiles

Initializing Tripwire Database
# tripwire --init

Modifying Tripwire policy file
# vi /etc/tripwire/twpol.txt

Once modifying all the files, update the tripwire policy file.
# tripwire --update-policy --secure-mode low /etc/tripwire/twpol.txt

Checking for any changes in files/directories
# tripwire --check --interactive

It will ask you to enter passwords

Now let us add a new file called Anil.
# touch Anil

Now check this file with tripwire ?check ?interactive command. You may find the file Anil under the Added section in the result
# tripwire --check --interactive

OR

# tripwire --check
It will not ask you to enter password

Viewing the tripwire report file
All tripwire report files having extension .twr are stored in /var/lib/tripwire/report/ directory. These are not text files, so you can?t view them using any editor. First convert them using the following command to human readable format.
# twprint --print-report --twrfile /var/lib/tripwire/report/server.ostechnix.com-20130510-124159.twr > /tmp/twrreport.txt

Now open the file using any editor.
# vi /tmp/twrreport.txt 

Viewing tripwire configuration and policy file locations
To view the policy file locations enter the following command.

#twadmin --print-polfile

To view the configuration files enter the following command.
# twadmin --print-cfgfile

Scheduling Tripwire Check
You may find a cron file tripwire-check might be created automatically in the /etc/cron.daily/ directory. If it isn?t created, open your crontab file and add lines as shown below. The following example will execute the tripwire daily at 5 am.

# vi /etc/crontab 
# Tripwire Monitor process
00 5 * * * /usr/sbin/tripwire  --check

OR

0 7 * * * /usr/sbin/tripwire --check > /mnt/tripwire
0 8 * * * /bin/mail -s "Tripwire" amullapudi@ciphercloud.com  < /tmp/tripwire

It will check system at 7 AM of everyday,everyweek,every month,every year and it will send an email on same.

========================================================================


networking commands to track ip address


In previous post  i have introduced simple networking command to keep track  ip address
of any website.To day am going to tel you few simple networking commands to keep
keep track ip journey.

Commands:

1. tracert
2. netstat
3. nslookup

1.tracert:

Tracert (traceroute) is another command adopted from Unix system. When ever you try
to open any website from your computer.We request our computer to go to that website
IP address by hopping into a few router address and fetch the website for you,tracert
is networking command and which is used to track hopping path.

PROCEDURE:

1.Open Command prompt and type cmd.




2.In command prompt simply type tracert sitename

tracert command





















From the above picture you can see it your trying to trace Google routing path from
your computer it has taken 12 router paths. and It differs with internet speed.


2.netstat:

Netstat displays the active TCP connections and ports on which the computer is listening, Ethernet statistics, the IP routing table, statistics for the IP, ICMP, TCP, and UDP protocols. Netstat also can be used to tracking your outbound or inbound connection to your computer, it’s useful to malicious connection. Let’s see the picture below to see the available switch in netstat. 

PROCEDURE:

1.Open Command prompt and type cmd.













2.In command prompt simply type netstat















In above picture you can see all active networking connections.You can also find which
port correctly listings.type following command.

netstat -np TCP | find "80"


3.nslookup:

This command helps to diagnose the Domain Name System (DNS) infrastructure and comes with a number of sub-commands. Usually used by hackers to find out some useful information that you can’t find on search engine. In this tips and trick I’m only show you how to find server IP address or host name. Type nslookup and the enter the URL of website you want to know it’s IP address for example I use Google. 

PROCEDURE:


1.Open Command prompt and type cmd.
2.In command prompt simply type nslookup
3.Type website  name.













In above image you can see Google actually using couple of address. Google can be pinged 
from any of above address.


file share using lan















Hi Students today i will guide you to share large files between windows systems using  RJ45 LAN cable.Some times we need copy large amount of data between two systems.
   Generally we students use Pen drives for making data copy but Pen drives have their 
   Own limitation Example: We have take dump of 50 GB data from another laptop here
   If you use 4 GB pen drive you will have use it around 15 times to make sure all data get
   Copied but this method leads to USB ports get damage and time consuming process.

Solutions:
    1.File share use GHOSTING method
    2.File share use  CROSS LAN cable

File Sharing Using LAN Cable:


Requirements: Double End RJ45 LAN Cable, LAN Port Enabled Windows Systems 

Procedure:

Step 1: First you have to configure IP address of both systems and Make sure both system
           Are having same work group name. To know and configure work group name just
           Right click MY COMPUTER Click on properties,You will see work group name and 
           Change settings option.Like picture shown bellow.

wrok group
Step 2: Second you have to configure IP address of both systems.set sequence address.
Step 3: Do follow bellow steps to configure IP address

            Step 3.1: Type Network in windows search. From results choose bellow option

sharing window

            Step 3.2: Then choose Adapter settings option from right sidebar

network window

            Step 3.3: Right click on LOCAL AREA NETWORK choose properties->select
                          IP V4 and choose properties option.

ip configuration window

ipv4 settings window

            Step 3.4: Set Source----------->IP: 192.168.1.15
                                Destination----->IP:  192.168.1.16
            Step 3.5 Once you got successfully configured IP Address. Put Cables in physical 
                         Ports and restart both systems(Some times Required).

Step 4: Next you will need turn on network Discovery option by following bellow path
          Control Panel\All Control Panel Items\Network and Sharing Center\Advanced    
          sharing settings
Step 5: After this open run box(Win+R) and type Work Group name of system from which
           You would like to share data. It will ask for Credentials provide them.
Step 6: Next share files on source system follow picture shown bellow.
                   --->Right click on file you wants to share
                   --->Select second Tab and choose Advance Sharing
                   
sharing window

Step 7: After this Repeat step 5 on destination system.
Step 8: Thats it your done.
                                       Please ask questions in comment section



File sharing between laptops using LAN cable in windows
Finding IP address of any website










Introduction
In this post am going to tel simple trick to know IP Address of any website.As known every
Web site is referenced by the special and unique id called IP address.We can easily know
it with PING command.

PING:

PING is a Networking command . This command is used to test weather the destination 
Computer can communicate over the network. In technical terms PING sends an Internet
Control Message Protocol to destination computer and it waits for response. Response information Contains basic information like ip address size of data it returns all.

Procedure:

Step 1: Press Windows+R then RUN command box will come
Step 2: Just type cmd and press Enter As shown in bellow image

command window

Step 3: After this Command prompt will come.
Step 4: Type following commands
                                       ->cd\
                                       ->ping www.websitename.com

command prompt

Step 5: In my example i wrote www.dropbox.com as destination site name.
Step 6: You can see in above image 199.47.217.170 is IP address of Dropbox.com
Step 7: That's it your done.

                                      Put your questions in Comment section