s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

aide

Advanced Intrusion Detection Environment: take a baseline of file hashes and permissions, then report every change.

Niveau
DevSecOps-service
Groep
Beveiligingsscans en hardening
Root nodig
Ja
Pakket
aide

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

AIDE builds a database of chosen files (hashes, owner, permissions, SELinux context, ACLs, inode). Later aide --check compares the system with the database and lists added, removed and changed files — for example a changed /usr/bin/ssh or a new SUID binary. This is file integrity monitoring (FIM), required by PCI-DSS, CIS and STIG.

After you update packages on purpose, you update the baseline.

Zo schrijf je het

aide --init | --check | --update | --compare [--config FILE]

Belangrijkste delen

Modes

--init
Build a new database.
--check
Compare the system with the database.
--update
Check and write a new database.
--compare
Compare two databases.
--config-check
Check the config syntax.

Opties 5

Meest gebruikt

Flags and config words

-c, --config FILE
Config file (default /etc/aide.conf).
-l, --limit REGEX
Check only matching paths.
-r, --report URL
Where to write the report (stdout, file:…).
NORMAL / CONTENT_EX / PERMS
Rule groups in aide.conf.
!/path
Exclude a path in aide.conf.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

  1. 1Install and make the baseline

    dnf install -y aide
aide --init
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

  2. 2Check for changes

    aide --check
AIDE found differences between database and filesystem!!
Summary:
  Total number of entries:      61234
  Added entries:                1
  Changed entries:              2

  3. 3Check only one folder

    aide --check --limit /etc/ssh

  4. 4Accept changes after a planned update

    dnf update -y
aide --update
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

  5. 5Run every night with a timer

    cat /etc/systemd/system/aide-check.service
[Service]
Type=oneshot
ExecStart=/usr/sbin/aide --check
cat /etc/systemd/system/aide-check.timer
[Timer]
OnCalendar=*-*-* 04:05:00
[Install]
WantedBy=timers.target
systemctl enable --now aide-check.timer

  6. 6Watch your own app folder

    cat /etc/aide.conf.d/shop.conf
/srv/shop/bin CONTENT_EX
!/srv/shop/logs

  7. 7Check the config

    aide --config-check

  8. 8Keep the database safe (copy off the host)

    sha256sum /var/lib/aide/aide.db.gz
scp /var/lib/aide/aide.db.gz backup@vault.lab.local:aide/web1-$(date +%F).db.gz

  9. 9Compare with RPM's own checks

    rpm -Va | grep -v "^.......T" | head

  10. 10Send the report to the journal

    aide --check | systemd-cat -t aide

Let op

  • An attacker with root can change the database too: keep a copy (or its hash) off the host.
  • Exclude log and cache folders, or every check is full of noise.

Bestanden

/etc/aide.conf
Rules and paths.
/var/lib/aide/aide.db.gz
The baseline database.
/var/log/aide/aide.log
Log.

Tips om te onthouden

  • The codes 1, 2 and 4 are added together: 7 = new, removed and changed files.
  • In containers and immutable systems (bootc) use image signatures instead; AIDE is for classic servers.

Exitcodes

0No differences.
1New files found.
2Removed files found.
4Changed files found.
14Error writing the database.
15Invalid argument.
17Invalid configuration.
18Input/output error.

Volledige handleiding

Deze pagina legt het commando uit in eenvoudige woorden. De originele handleiding heeft elk detail.

In je terminal: man aide

Open de man-pagina (linux.die.net)docs.redhat.com