AC Hosting Environment

AC Hosting Environment Documentation
  • 1 Release Notes
    • 1.1 End-Of-Life (EOL) Notice
    • 1.2 Support Policy
    • 1.3 Differences to CentOS
  • 2 Deployment
    • 2.1 Prerequisites
    • 2.2 Preparing to Install
    • 2.3 Installation
    • 2.4 Post Installation Steps
  • 3 AC Tools
    • 3.1 AC Configure Syslog
      • 3.1.1 Introduction
      • 3.1.2 Un/Installation
      • 3.1.3 Usage
    • 3.2 AC Firewall
      • 3.2.1 Introduction
      • 3.2.2 Un/Installation
      • 3.2.3 Usage
    • 3.3 AC Integrity
      • 3.3.1 Introduction
      • 3.3.2 Un/Installation
      • 3.3.3 Usage
      • 3.3.4 Integration Tips
    • 3.4 Make Bash Installer
      • 3.4.1 Introduction
      • 3.4.2 Un/Installation
      • 3.4.3 Usage
    • 3.5 AC X509 Authority
      • 3.5.1 Introduction
      • 3.5.2 Un/Installation
      • 3.5.3 Command Reference
      • 3.5.4 Certificates For Beginners
      • 3.5.5 CA Management
      • 3.5.6 Server, Client, and User Certificate Management
      • 3.5.7 Reporting Commands
      • 3.5.8 Troubleshooting

3.3.3 Usage

September 13th, 2025

AC Integrity runs as a service but can be controlled directly. Correct configuration of AC Integrity is performed using the following:

  • Configuration files
  • The systemctl command
  • The ac_integrity command

3.3.3.1 Service control via systemd (systemctl)

start '# systemctl start ac_integrity.service'
stop '# systemctl stop ac_integrity.service'
restart '# systemctl restart ac_integrity.service'
status '# systemctl status ac_integrity.service'
disable '# systemctl disable ac_integrity.service'
enable # systemctl enable ac_integrity.service

Remember to stop AC Integrity when making system configuration changes.

3.3.3.2 Direct control via ac_integrity

Usage

# ac_integrity <option> [<optional>] [--verbose]

Options
update-db Updates the AC-Integrity checksum database. If an optional class is supplied, only that class will be updated.
start Turns on automatic file checksum monitoring. If optional boot flag is supplied, checksums will be checked at boot time too.
stop Turns off AC-Integrity. If optional boot flag is supplied, the checksums will not be checked on boot time either.
check Performs an on-demand file checksum check. If an optional class is supplied, only that class will be checked.
status Reports whether AC-Integrity is active and outputs all violation events since the last update-db.
version Outputs version info.
--verbose Verbose output causes all checksums and file check operations to be output to the shell. This is mainly only useful for debugging or helping AC Integrity interact with another program.

3.3.3.3 Configuration Files

Actually configuring AC Integrity is performed via configuration files located in /etc/ac_integrity.

File Purpose Notes
lists.conf Contains paths to all files and directories that should be scanned and what class they belong to.
classes/ Directory contains all the class definition files
classes/* Class definition file. Simple INI file.

By default severe and critical classes are built-in.

lists.conf

This is a simple file containing two columns separated by one or more spaces or tabs. Blank lines and lines beginning with the "#" character are ignored. The first column indicates a file or directory to be scanned. The second column indicates the class that file belongs to. Here is an example of the default lists.conf file.

# configuration file for AC-Integrity # FILE/DIRECTORY CLASS /etc/sysconfig critical /etc/systemd critical /root/.bash_profile critical /boot critical /etc/ssh severe /sbin severe /usr/sbin severe /bin severe /usr/bin severe

All paths must be absolute.

classes/*

Class files are short INI files which describe how files in a specific class should be handled. Blank lines and lines beginning with the "#" character are ignored. The name of the file must correspond to the class names in lists.conf. The format is described below.

Variable Format Notes
CLASS A text string indicating the class name. Does not need to match the file name, but usually will.
LOG TRUE or FALSE Whether to send violations to Syslog.
EMAIL TRUE or FALSE Whether to send violations to a mail recipient.
MAILTO Blank or a valid email address Used is EMAIL is set to TRUE as the recipient for violations.
EXECUTE Blank or absolute path to an executable file. Options and flags should not be used. If it exists, violations will trigger execution as root.
HALT TRUE or FALSE Whether to shut down the system on violation.
ALGORHYTHM MD5, SHA1, SHA224, SHA256, SHA384 or SHA512 Supported algorithms may vary depending on Linux release.
ON_BOOT TRUE or FALSE Whether to scan for violations at boot time.
FREQUENCY 30MIN, HOUR, DAILY or NEVER

Here is an example of the built-in critical class file at /etc/ac_integrity/classes/critical.

############################################################################## # AC-Integrity event class definition # ############################################################################## CLASS=critical LOG=TRUE EMAIL=FALSE MAILTO= EXECUTE= HALT=FALSE # Can be MD5, SHA1, SHA224, SHA256, SHA384 or SHA512 ALGORHYTHM=SHA1 ON_BOOT=TRUE # Can be '30MIN', 'HOUR', 'DAILY' or 'NEVER' FREQUENCY=DAILY

previous: Un/Installation next: Integration Tips