Revision as of 09:37, 11 May 2016

Introduction

ASL has an advanced file integrity manager built in that will alert you if file changes have occurred on your system. ASL does not use rkhunter for this.

Accessing

To access the ASL file intergrity manager, follow this process

Step 1) Log into the ASL web console

Step 2) Click on the ASL tab

Step 3) Scroll down to File Integrity and click on that option.

This will open the file integrity manager.

If any files have changed, that the system is configured to monitor, it will display them in this window under the "Files" Tab.

Using

If ASL does not show any file integrity changes

This means that any changes to the file system, such as inodes changing for a file, are benign and ASL has determined these were authorized and non-malicious changes to the system.

Configuring

Step 1) Log into the ASL web console

Step 2) Click on the ASL tab

Step 3) Scroll down to File Integrity and click on that option.

This will open the file integrity manager.

Step 4) Click on the "Options" tab.

This will open the file integrity manager options page.

Global Options

Scan Timing

If you are using the ASL kernel, file integrity checks happen in real time and you do not need to configure this. If a file changes, and you have not put a limit on the number of emails ASL is allowed to send per hour, ASL will immediately alert you via email and the web console if a watched file or directory changes.

If you are not using the ASL kernel, and your kernel does not support inotify, you will need to set the scan timing frequency for when ASL will checks your files for changes.

Frequency

This setting tells ASL, when the ASL kernel is not being used, how often to check for file changes. If you are using the ASL kernel checks happen in real time you do not need to set this.

This setting is in hours : minutes : seconds.

For example, if you want to set this happen every hour, you would set this to 1:0:0

Scan Day

You can also set a specific day for the scans to run, if you only wish to run them periodically. Again, if you are using the ASL kernel checks happen in real time you do not need to set this.

Scan Time

Optional Setting: You can also set the specific time to run the checks. Again, if you are using the ASL kernel checks happen in real time you do not need to set this.

Scan Options

Auto-ignore frequently modified?

ASL can also learn if a file changes regularly to ignore previous notifications of changes to this file.

Alert on new file creation?

ASL can alert on new files that are created in watched directories.

Scan on startup?

This tells ASL to build its list of files to watch on startup. We do not recommend you disable this, as ASL will not be able to notify of any changes to your files until its down its initial scan.

Directories

This window lists the directories, and optionally the files, that ASL has been configured to monitor.

add a new rule

watch

This tells ASL to watch a directory or file, and to report the specific changes that have occurred to this file or directory. ASL will report the previous portion of the file, and the changed portion so you can compare them. ASL will maintain copies of all changes to the files it is told to watch, and you can you this information to roll back changes and to do deep inspection of changes as opposed to trying to determine what specifically happened to the file.

ASL will also report this information, if selected:

• Sum
• SHA1
• MD5
• Size
• Owner
• Group
• Permissions

notify

This tells ASL to notify you if a directory or file has changed. This will not report the specific changes that have occurred to this file or directory, except for, if selected:

• Sum
• SHA1
• MD5
• Size
• Owner
• Group
• Permissions

ignore

This tells ASL to ignore a specific file or directory. This is useful if you want to ignore a file or files in a directory you otherwise want to monitor or notify.