0

is it possible to compare the changed file when using AIDE? In the automatic Email only the SHA256 will be compared. It would be pretty cool if i can see what changed, maybe with a diff or something.

Thanks for your response! Greetings

vanishedd
  • 3
  • 2

1 Answers1

0

No. AIDE can’t offer you a diff.

For AIDE to be able to generate such a diff, it would have to have an original copy of every file you monitor.

And as far as I know AIDE does not create such copies, it only creates a list of hashes. (And a list of hashes is much smaller than a full copy of your system so you can easily put the AIDE hashes on a removable medium out of reach from an adversary getting access to your server. )

HBruijn
  • 77,029
  • 24
  • 135
  • 201