aide

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

AIDE builds a database of chosen files (hashes, owner, permissions, SELinux context, ACLs, inode). Later aide --check compares the system with the database and lists added, removed and changed files — for example a changed /usr/bin/ssh or a new SUID binary. This is file integrity monitoring (FIM), required by PCI-DSS, CIS and STIG.

After you update packages on purpose, you update the baseline.

طريقة الكتابة

aide --init | --check | --update | --compare [--config FILE]

الأجزاء الرئيسية

Modes

--init: Build a new database.
--check: Compare the system with the database.
--update: Check and write a new database.
--compare: Compare two databases.
--config-check: Check the config syntax.

الخيارات 5

الأكثر استخدامًا

Flags and config words

-c, --config FILE: Config file (default /etc/aide.conf).
-l, --limit REGEX: Check only matching paths.
-r, --report URL: Where to write the report (stdout, file:…).
NORMAL / CONTENT_EX / PERMS: Rule groups in aide.conf.
!/path: Exclude a path in aide.conf.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Install and make the baseline

#dnf install -y aide
#aide --init
#mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

2Check for changes

#aide --check
AIDE found differences between database and filesystem!!
Summary:
  Total number of entries:      61234
  Added entries:                1
  Changed entries:              2

3Check only one folder
```
#aide --check --limit /etc/ssh
```

4Accept changes after a planned update

#dnf update -y
#aide --update
#mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

5Run every night with a timer

#cat /etc/systemd/system/aide-check.service
[Service]
Type=oneshot
ExecStart=/usr/sbin/aide --check
#cat /etc/systemd/system/aide-check.timer
[Timer]
OnCalendar=*-*-* 04:05:00
[Install]
WantedBy=timers.target
#systemctl enable --now aide-check.timer

6Watch your own app folder

#cat /etc/aide.conf.d/shop.conf
/srv/shop/bin CONTENT_EX
!/srv/shop/logs

7Check the config
```
#aide --config-check
```

8Keep the database safe (copy off the host)

#sha256sum /var/lib/aide/aide.db.gz
#scp /var/lib/aide/aide.db.gz backup@vault.lab.local:aide/web1-$(date +%F).db.gz

9Compare with RPM's own checks
```
#rpm -Va | grep -v "^.......T" | head
```
10Send the report to the journal
```
#aide --check | systemd-cat -t aide
```

انتبه

An attacker with root can change the database too: keep a copy (or its hash) off the host.
Exclude log and cache folders, or every check is full of noise.

الملفات

/etc/aide.conf: Rules and paths.
/var/lib/aide/aide.db.gz: The baseline database.
/var/log/aide/aide.log: Log.

نصائح للحفظ

The codes 1, 2 and 4 are added together: 7 = new, removed and changed files.
In containers and immutable systems (bootc) use image signatures instead; AIDE is for classic servers.

رموز الخروج

`0`	No differences.
`1`	New files found.
`2`	Removed files found.
`4`	Changed files found.
`14`	Error writing the database.
`15`	Invalid argument.
`17`	Invalid configuration.
`18`	Input/output error.

`aide`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Modes

الخيارات 5

Flags and config words

أمثلة 10

1Install and make the baseline

2Check for changes

3Check only one folder

4Accept changes after a planned update

5Run every night with a timer

6Watch your own app folder

7Check the config

8Keep the database safe (copy off the host)

9Compare with RPM's own checks

10Send the report to the journal

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Modes

الخيارات 5

Flags and config words

أمثلة 10

1Install and make the baseline

2Check for changes

3Check only one folder

4Accept changes after a planned update

5Run every night with a timer

6Watch your own app folder

7Check the config

8Keep the database safe (copy off the host)

9Compare with RPM's own checks

10Send the report to the journal

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`aide`