Intro til aide

1. AIDE
In 5 min

2. About
● AIDE (Advanced Intrusion Detection
Environment) is a file integrity checker and
intrusion detection program
● Open Source version of old tripwire (they
stopped giving it out for free)
● Scan's all files when you ask it to check
● Included in redhat (and most other linux
distros)
● Doesn’t use inotify but actually scans the file
system :(

3. Installation
yum install aide

4. Configuration
● Config file /etc/aide.conf
Examples:
#p: permissions
#i: inode:
#n: number of links
#u: user
R = p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
NORMAL = R+rmd160+sha256
LSPP = R+sha256
/boot NORMAL
!/usr/src
/etc/exports NORMAL

5. Initialization
● /usr/sbin/aide --init
● Copy /etc/aide.conf, /usr/sbin/aide og
/var/lib/aide/aide.db.new.gz to somewhere
the hacker can't reach
● cp /var/lib/aide/aide.db.new.gz
/var/lib/aide/aide.db.gz

6. Check
/usr/sbin/aide --check

7. Examples - ok
root@e3639.test audit# /usr/sbin/aide --check
AIDE, version 0.14
### All files match AIDE database. Looks okay!
root@e3639.test audit# echo $?
0

8. Examples - error
root@e3639.test audit# /usr/sbin/aide --check
File /etc/exports in databases has different attributes, 340205bbd,240205bbd
AIDE found differences between database and filesystem!!
Start timestamp: 2013-07-15 15:34:44
Summary:
Total number of files: 34733
Added files: 0
Removed files: 0
Changed files: 1
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /etc/exports
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
File: /etc/exports
Size : 0 , 6
Mtime : 2010-01-12 14:28:22 , 2013-07-15 15:34:41
Ctime : 2013-07-15 14:31:36 , 2013-07-15 15:34:41
Inode : 655386 , 656673
MD5 : 1B2M2Y8AsgTpgAmY7PhCfg== , 5uWc72GV8mpdqdgqdbmzsQ==
RMD160 : nBGFpcXp/FRhKAiXfuj1SLIljTE= , aA5YkaTWmNi9lmKpCp71EX2i8xA=
SHA256 : 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NM , z3ceDKelQcXnhgn29vAFNkXskiit8BPN
SELinux : system_u:object_r:exports_t:s0 , <NULL>
root@e3639.test audit# echo $?
4