4.5.1. Vulnerability Scanning and File Integrity
💡 First Principle: Vulnerabilities are known weaknesses; CVEs (Common Vulnerabilities and Exposures) are their standardized identifiers. CVSS (Common Vulnerability Scoring System) scores them 0–10 by severity. Patch management is the systematic process of applying fixes — backporting patches applies security fixes to the installed version without upgrading the entire package.
Vulnerability Management Concepts:
| Term | Definition |
|---|---|
| CVE | Unique identifier for a publicly known vulnerability (e.g., CVE-2021-44228) |
| CVSS | Score 0–10 quantifying severity (Base, Temporal, Environmental metrics) |
| Backporting | Applying a security fix to the installed package version rather than upgrading to a new major version |
| Service misconfiguration | Vulnerable settings (default credentials, open ports, world-writable files) |
| Port scanner | Tool that identifies open ports and services (nmap) |
| Protocol analyzer | Captures and decodes network traffic (tcpdump, Wireshark) |
# nmap — network port scanner
nmap -sV 192.168.1.100 # Detect open ports + service versions
nmap -sV -sC 192.168.1.100 # Also run default scripts
nmap -p 80,443,22 192.168.1.0/24 # Scan specific ports across subnet
nmap -O 192.168.1.100 # OS detection
nmap --script vuln 192.168.1.100 # Run vulnerability detection scripts
# tcpdump — protocol analyzer
tcpdump -i eth0 # Capture all traffic on eth0
tcpdump -i eth0 port 80 # HTTP traffic only
tcpdump -i eth0 host 10.0.0.5 # Traffic to/from specific host
tcpdump -w /tmp/capture.pcap # Save to file for Wireshark analysis
tcpdump -r /tmp/capture.pcap # Read saved capture
AIDE — Advanced Intrusion Detection Environment:
AIDE builds a cryptographic database of file hashes, permissions, and metadata. Regular checks compare the current state against the database to detect unauthorized modifications.
# Initialize database (baseline — run after hardening, before production)
aide --init # Creates /var/lib/aide/aide.db.new
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db # Activate as baseline
# Run integrity check
aide --check # Compare current state against database
aide --update # Check + update database with legitimate changes
# Config: /etc/aide.conf
# Defines which directories to monitor and which attributes to check
rkhunter — Rootkit Hunter:
rkhunter --update # Update signature database
rkhunter --check # Scan for rootkits, backdoors, suspicious files
rkhunter --check --skip-keypress # Non-interactive (for cron)
Signed Package Verification:
rpm --verify httpd # RHEL: verify installed files against package checksum
rpm -Va # Verify ALL installed packages
dpkg --verify nginx # Debian: verify package file integrity
Software Supply Chain Security:
Verifying that software comes from trusted sources — checking GPG signatures on packages, verifying container image digests, using only approved registries — prevents supply chain attacks where malicious code is injected into the distribution pipeline.
⚠️ Exam Trap: AIDE must be initialized before production use — if you run aide --init on a system that's already been compromised, the database captures the compromised state as the "good" baseline. The init must happen on a known-clean system, immediately after hardening and before exposing the system to the network.
Reflection Question: After running aide --check, AIDE reports that /usr/bin/ls has changed its SHA-256 hash and size since the last database update. What is the significance of this finding and what are the two most likely explanations?
