AIDE : Host Based IDS2021/09/29 |
|
Install and configure Host Based IDS (Intrusion Detection System) [AIDE] (Advanced Intrusion Detection Environment).
|
|
| [1] | Install AIDE. |
|
root@dlp:~# apt -y install aide
|
| [2] | Configure AIDE and initialize database. It's possible to use AIDE with default settings but if you'd like to customize settings, change configuration file like follows. It's possible to see details of Setting rules with [man aide.conf]. |
|
root@dlp:~#
vi /etc/default/aide # line 8 : if you do not use Cron job, comment out and turn to [no] #CRON_DAILY_RUN=yes
root@dlp:~#
vi /etc/aide/aide.conf # add to the end : set exclude directories if you need
!/var/log
# initialize database root@dlp:~# aide --init --config /etc/aide/aide.conf
Start timestamp: 2021-09-29 11:46:16 +0900 (AIDE 0.17.3)
AIDE initialized database at /var/lib/aide/aide.db.new
Number of entries: 60348
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
/var/lib/aide/aide.db.new
SHA256 : keqGXwfYXPRH7T6f5Bg4G5d9NospEMml
Pd/ffXEPBcI=
SHA512 : BCM4g241I9eTn8fJEosFegosLFiDNKT2
/Vd18n8zS28lRAgkSVYwlC+1BFpMEGys
SrHva7FdrIRvmpxBbQ6yFw==
RMD160 : /QOh/U5fACDwYHIz/sL4kAnt6Nc=
TIGER : NJQ57tlVM3t/PvQFvoUzzVnWiEXDuNut
CRC32 : ABSl7w==
HAVAL : G1MC+Lkor9sHJSREYa34QXzmzhyinJ6b
RoruRWogdlM=
WHIRLPOOL : ujY6bMHVMFkggmyTaWlKnAKTJoPODJM/
iheCSiymzuSZn6ExK8DKq7IlJ1AzT+Bv
z3NHscmYHsp/jZEY5URtbg==
GOST : 8g+gWS5EHCymtIlCjaXzoo3DGa7SPP3E
H+agoHn90fE=
End timestamp: 2021-09-29 11:48:00 +0900 (run time: 1m 44s)
# copy generated DB to master DB root@dlp:~# cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
|
| [3] | Run ckecking. |
|
root@dlp:~#
aide --check --config /etc/aide/aide.conf # if thete is no unmatch, it displayed [*** Looks okay]
AIDE found NO differences between database and filesystem. Looks okay!!
Number of entries: 60348
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
/var/lib/aide/aide.db
SHA256 : keqGXwfYXPRH7T6f5Bg4G5d9NospEMml
Pd/ffXEPBcI=
SHA512 : BCM4g241I9eTn8fJEosFegosLFiDNKT2
/Vd18n8zS28lRAgkSVYwlC+1BFpMEGys
SrHva7FdrIRvmpxBbQ6yFw==
RMD160 : /QOh/U5fACDwYHIz/sL4kAnt6Nc=
TIGER : NJQ57tlVM3t/PvQFvoUzzVnWiEXDuNut
CRC32 : ABSl7w==
HAVAL : G1MC+Lkor9sHJSREYa34QXzmzhyinJ6b
RoruRWogdlM=
WHIRLPOOL : ujY6bMHVMFkggmyTaWlKnAKTJoPODJM/
iheCSiymzuSZn6ExK8DKq7IlJ1AzT+Bv
z3NHscmYHsp/jZEY5URtbg==
GOST : 8g+gWS5EHCymtIlCjaXzoo3DGa7SPP3E
H+agoHn90fE=
End timestamp: 2021-09-29 11:51:17 +0900 (run time: 2m 37s)
# try to change a file and check again root@dlp:~# touch /root/test.txt root@dlp:~# aide --check --config /etc/aide/aide.conf # detected differences like follows Start timestamp: 2021-09-29 11:52:25 +0900 (AIDE 0.17.3) AIDE found differences between database and filesystem!! Summary: Total number of entries: 60349 Added entries: 1 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Added entries: --------------------------------------------------- f+++++++++++++++++: /root/test.txt --------------------------------------------------- Changed entries: --------------------------------------------------- d =.... mc.. .. . : /root --------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /root Mtime : 2021-09-29 11:46:06 +0900 | 2021-09-29 11:51:54 +0900 Ctime : 2021-09-29 11:46:06 +0900 | 2021-09-29 11:51:54 +0900 ..... ..... |
| [4] | If there is no problem even if some differences are detected, then update database like follows. |
|
root@dlp:~#
aide --update --config /etc/aide/aide.conf Start timestamp: 2021-09-29 12:00:38 +0900 (AIDE 0.17.3) AIDE found differences between database and filesystem!! New AIDE database written to /var/lib/aide/aide.db.new Summary: Total number of entries: 60349 Added entries: 1 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Added entries: --------------------------------------------------- f+++++++++++++++++: /root/test.txt --------------------------------------------------- Changed entries: --------------------------------------------------- d =.... mc.. .. . : /root --------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /root Mtime : 2021-09-29 11:46:06 +0900 | 2021-09-29 11:51:54 +0900 Ctime : 2021-09-29 11:46:06 +0900 | 2021-09-29 11:51:54 +0900 ..... ..... # update databaseć–° root@dlp:~# cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
|
| Sponsored Link |