AC Hosting Environment

AC Hosting Environment Documentation
  • 1 Release Notes
    • 1.1 End-Of-Life (EOL) Notice
    • 1.2 Support Policy
    • 1.3 Differences to CentOS
  • 2 Deployment
    • 2.1 Prerequisites
    • 2.2 Preparing to Install
    • 2.3 Installation
    • 2.4 Post Installation Steps
  • 3 AC Tools
    • 3.1 AC Configure Syslog
      • 3.1.1 Introduction
      • 3.1.2 Un/Installation
      • 3.1.3 Usage
    • 3.2 AC Firewall
      • 3.2.1 Introduction
      • 3.2.2 Un/Installation
      • 3.2.3 Usage
    • 3.3 AC Integrity
      • 3.3.1 Introduction
      • 3.3.2 Un/Installation
      • 3.3.3 Usage
      • 3.3.4 Integration Tips
    • 3.4 Make Bash Installer
      • 3.4.1 Introduction
      • 3.4.2 Un/Installation
      • 3.4.3 Usage
    • 3.5 AC X509 Authority
      • 3.5.1 Introduction
      • 3.5.2 Un/Installation
      • 3.5.3 Command Reference
      • 3.5.4 Certificates For Beginners
      • 3.5.5 CA Management
      • 3.5.6 Server, Client, and User Certificate Management
      • 3.5.7 Reporting Commands
      • 3.5.8 Troubleshooting

3.3.1 Introduction

September 13th, 2025

AC Integrity a very simple tool for ensuring system and application file integrity with a focus on anti-tampering. In this respect it can be seen as similar to tools like Tripwire. However, AC Integrity provides an extremely simple, and pluggable, file-based interface and, therefore, lowers the bar for easy and accessible file tampering detection.

Core features of AC Integrity include:

  • Arbitrary user-defined rulesets (classes). Critical and Severe provided by default.
  • User definable scan frequency.
  • User definable action on violation detection. Can log, email, execute a program, or halt the system and any combination thereof.
  • User selectable hash algorithm.
  • On-boot scanning.

AC Integrity can be resource intensive if misconfigured. For each scan, all files and files in listed directories are read from disk and hashed. Scanning huge files or massively recursive directories may generate a significant IO and CPU workload.

Always disable the AC Integrity service on development hosts. This is to avoid false positives and potential system start up blockages caused by making frequent file changes.

3.3.1.1 User case examples

Example 1: Offline a compromised system

Company X Inc. operates a DNS server for their popular web portal. DNS hijacking is a constant concern. All DNS configuration files are part of the critical class and are scanned every 30 minutes. In the event that critical files related to the DNS server are modified unexpectedly, AC Integrity emails the administrator and performs a shutdown of the host to prevent further operation in a compromised state.

Example 2: Deny boot

XY Investment Banking PLC have several hosts connected directly to SWIFTNet to facilitate their financial transaction messaging. Any compromise of this system could result in catastrophic financial loss and possibly a revoked banking license. All these hosts are shut down for several hours each weekend to coincide with SWIFT's allowable downtime windows. As well as periodic scanning, AC Integrity is configured to perform a scan on boot up. If a violation is detected, an email is sent to the administrator and a program is executed to block all traffic to SWIFTNet for all their hosts (not just this one). Further boot is then halted pending manual intervention and override.

previous: Usage next: Un/Installation