AIDE : Host Based IDS2024/06/19 |
Install and configure Host Based IDS (Intrusion Detection System) [AIDE] (Advanced Intrusion Detection Environment). |
|
[1] | Install AIDE. |
root@dlp:~# apt -y install aide
|
[2] | Configure AIDE and initialize database. It's possible to use AIDE with default settings but if you'd like to customize settings, change configuration file like follows. It's possible to see details of Setting rules with [man aide.conf]. |
root@dlp:~#
vi /etc/default/aide # line 8 : if you do not use Cron job, comment out and turn to [no] #CRON_DAILY_RUN=yes
root@dlp:~#
vi /etc/aide/aide.conf # add to last line : set exclude directories if you need
!/var/log
!/var/lib/aide !/var/lib/apt !/var/lib/dpkg !/var/cache !/run # initialize database root@dlp:~# aide --init --config /etc/aide/aide.conf Start timestamp: 2024-06-19 00:26:20 +0000 (AIDE 0.18.6) AIDE successfully initialized database. New AIDE database written to /var/lib/aide/aide.db.new Ignored e2fs attributes: EINV Number of entries: 129989 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new MD5 : 7c6rXJ8Ya1zBrT69oz2Ckw== SHA1 : c8ASv/14g8ts3oLJx+ERcO0A4L4= SHA256 : 91xdDJbYp03WdErPL8WGWVfQn4eE/DEj O9mXYcYKAlA= SHA512 : Ubp7cw3dJ09lUqyyVm7lh46mfhs4JlIm 22J9BtqHmtTaW2egkHfuj2MVYtNyrKkY 3oredDWzsjA7HLru3GsiQg== RMD160 : suAcpe1q0dWG0rvVEefGPj78QFw= TIGER : i/ltOms38A8r2AlkNmed1YbO2iF71pSe CRC32 : lIIuqQ== CRC32B : i70DbA== HAVAL : IBt7FX46tH/KBiJibPEYukWb3BANb+o8 4fAPe2GK6DM= WHIRLPOOL : R2Do90WTJFNCpvVVDe73KkAX6HbzFHHC MnbEgswqefb4wd9t41xHRxoNojmU38Th h7p9O6VnwcIKWt4FLrsbBA== GOST : Lq2zhQkjy5LG4tEjOf/Dh2Br06l4OOFb trboBfl3XYs= End timestamp: 2024-06-19 00:31:14 +0000 (run time: 4m 54s) # copy generated DB to master DB root@dlp:~# cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
|
[3] | Run checking. |
root@dlp:~#
aide --check --config /etc/aide/aide.conf # if thete is no unmatch, it displayed [*** Looks okay] Start timestamp: 2024-06-19 00:32:25 +0000 (AIDE 0.18.6) AIDE found NO differences between database and filesystem. Looks okay!! Ignored e2fs attributes: EINV Number of entries: 129989 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db MD5 : 7c6rXJ8Ya1zBrT69oz2Ckw== SHA1 : c8ASv/14g8ts3oLJx+ERcO0A4L4= SHA256 : 91xdDJbYp03WdErPL8WGWVfQn4eE/DEj O9mXYcYKAlA= SHA512 : Ubp7cw3dJ09lUqyyVm7lh46mfhs4JlIm 22J9BtqHmtTaW2egkHfuj2MVYtNyrKkY 3oredDWzsjA7HLru3GsiQg== RMD160 : suAcpe1q0dWG0rvVEefGPj78QFw= TIGER : i/ltOms38A8r2AlkNmed1YbO2iF71pSe CRC32 : lIIuqQ== CRC32B : i70DbA== HAVAL : IBt7FX46tH/KBiJibPEYukWb3BANb+o8 4fAPe2GK6DM= WHIRLPOOL : R2Do90WTJFNCpvVVDe73KkAX6HbzFHHC MnbEgswqefb4wd9t41xHRxoNojmU38Th h7p9O6VnwcIKWt4FLrsbBA== GOST : Lq2zhQkjy5LG4tEjOf/Dh2Br06l4OOFb trboBfl3XYs= End timestamp: 2024-06-19 00:39:54 +0000 (run time: 7m 29s) # try to change a file and check again root@dlp:~# touch /root/test.txt root@dlp:~# aide --check --config /etc/aide/aide.conf # detected differences like follows Start timestamp: 2024-06-19 00:40:40 +0000 (AIDE 0.18.6) AIDE found differences between database and filesystem!! Ignored e2fs attributes: EINV Summary: Total number of entries: 129990 Added entries: 1 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Added entries: --------------------------------------------------- f+++++++++++++++++: /root/test.txt --------------------------------------------------- Changed entries: --------------------------------------------------- d =.... mc.. .. . : /root --------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /root Mtime : 2024-06-19 00:26:12 +0000 | 2024-06-19 00:40:35 +0000 Ctime : 2024-06-19 00:26:12 +0000 | 2024-06-19 00:40:35 +0000 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db MD5 : 7c6rXJ8Ya1zBrT69oz2Ckw== SHA1 : c8ASv/14g8ts3oLJx+ERcO0A4L4= SHA256 : 91xdDJbYp03WdErPL8WGWVfQn4eE/DEj O9mXYcYKAlA= SHA512 : Ubp7cw3dJ09lUqyyVm7lh46mfhs4JlIm 22J9BtqHmtTaW2egkHfuj2MVYtNyrKkY 3oredDWzsjA7HLru3GsiQg== RMD160 : suAcpe1q0dWG0rvVEefGPj78QFw= TIGER : i/ltOms38A8r2AlkNmed1YbO2iF71pSe CRC32 : lIIuqQ== CRC32B : i70DbA== HAVAL : IBt7FX46tH/KBiJibPEYukWb3BANb+o8 4fAPe2GK6DM= WHIRLPOOL : R2Do90WTJFNCpvVVDe73KkAX6HbzFHHC MnbEgswqefb4wd9t41xHRxoNojmU38Th h7p9O6VnwcIKWt4FLrsbBA== GOST : Lq2zhQkjy5LG4tEjOf/Dh2Br06l4OOFb trboBfl3XYs= End timestamp: 2024-06-19 00:48:14 +0000 (run time: 7m 34s) |
[4] | If there is no problem even if some differences are detected, then update database like follows. |
root@dlp:~#
aide --update --config /etc/aide/aide.conf Start timestamp: 2024-06-19 00:54:24 +0000 (AIDE 0.18.6) AIDE found differences between database and filesystem!! New AIDE database written to /var/lib/aide/aide.db.new Ignored e2fs attributes: EINV Summary: Total number of entries: 129990 Added entries: 1 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Added entries: --------------------------------------------------- f+++++++++++++++++: /root/test.txt --------------------------------------------------- Changed entries: --------------------------------------------------- d =.... mc.. .. . : /root --------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /root Mtime : 2024-06-19 00:26:12 +0000 | 2024-06-19 00:40:35 +0000 Ctime : 2024-06-19 00:26:12 +0000 | 2024-06-19 00:40:35 +0000 ..... ..... # update database root@dlp:~# cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
|
Sponsored Link |
|