AIDE : Install2022/06/28

	Install and configure Host Based IDS (Intrusion Detection System) [AIDE] (Advanced Intrusion Detection Environment).
[1]	Install AIDE.

[root@dlp ~]#

dnf -y install aide

[2]	Configure AIDE and initialize database. It's possible to use AIDE with default config but if you'd like to customize settings, change configuration file like follows. Setting rules are writen near 26-84 lines, refer to them.

[root@dlp ~]#

vi /etc/aide.conf

# line 26: description for setting rules

# These are the default rules.
#
#p:      permissions
#i:      inode:
#n:      number of links
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#acl:           Access Control Lists
#selinux        SELinux security context
#xattrs:        Extended file attributes
#md5:    md5 checksum
#sha1:   sha1 checksum
#sha256:        sha256 checksum
#sha512:        sha512 checksum

# initialize database

[root@dlp ~]#

aide --init

Start timestamp: 2022-06-28 15:10:37 +0900 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz

Number of entries:      66430

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new.gz

.....
.....

# copy generated DB to master DB

[root@dlp ~]#

cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

[3]	Run checking.

[root@dlp ~]#

aide --check

# if there is no unmatch, it displayed [Looks okay]

Start timestamp: 2022-06-28 15:11:54 +0900 (AIDE 0.16)
AIDE found NO differences between database and filesystem. Looks okay!!

Number of entries:      66430

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz

.....
.....

# try to change a file and check again

[root@dlp ~]#

chmod 640 /root/anaconda-ks.cfg

[root@dlp ~]#

aide --check

# detected differences like follows

Start timestamp: 2022-06-28 15:13:36 +0900 (AIDE 0.16)
AIDE found differences between database and filesystem!!

Summary:
  Total number of entries:      66430
  Added entries:                0
  Removed entries:              0
  Changed entries:              1

---------------------------------------------------
Changed entries:
---------------------------------------------------

f   p..    ..A.. : /root/anaconda-ks.cfg

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /root/anaconda-ks.cfg
  Perm     : -rw-------                       | -rw-r-----
  ACL      : A: user::rw-                     | A: user::rw-
             A: group::---                    | A: group::r--
             A: other::---                    | A: other::---


---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz

.....
.....

[4]	If there is no problem even if some differences are detected, then update database like follows.

[root@dlp ~]#

aide --update

Start timestamp: 2022-06-28 15:14:35 +0900 (AIDE 0.16)
AIDE found differences between database and filesystem!!
New AIDE database written to /var/lib/aide/aide.db.new.gz

Summary:
  Total number of entries:      66430
  Added entries:                0
  Removed entries:              0
  Changed entries:              1

---------------------------------------------------
Changed entries:
---------------------------------------------------

f   p..    ..A.. : /root/anaconda-ks.cfg

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /root/anaconda-ks.cfg
  Perm     : -rw-------                       | -rw-r-----
  ACL      : A: user::rw-                     | A: user::rw-
             A: group::---                    | A: group::r--
             A: other::---                    | A: other::---


---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz

.....
.....

# update database

[root@dlp ~]#

cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

[5]	Add in Cron if you'd like to check regulary. Log file [/var/log/aide/aide.log] is updated every time, so if you's like to save log files, it needs to create a shell script or send results via email or others.

# for example, add daily check in Crontab and send results via email

[root@dlp ~]#

vi /etc/cron.d/aide

00 01 * * * root /usr/sbin/aide --update | mail -s 'Daily Check by AIDE' root

Matched Content