# tar xzvf aide-0.9.tar.gz # cd aide-0.9 # ./configure # make # make install
Many Distros have it available precompiled.
# cat /etc/aide/aide.conf database=file:/var/lib/aide/aide.db database_out=file:/var/lib/aide/aide.db.new # Change this to "no" or remove it to not gzip output # (only useful on systems with few CPU cycles to spare) gzip_dbout=yes # Here are all the things we can check - these are the default rules # # p: permissions # i: inode # n: number of links # u: user # g: group # s: size # b: block count # m: mtime # a: atime # c: ctime # S: check for growing size # md5: md5 checksum # sha1: sha1 checksum # rmd160: rmd160 checksum # tiger: tiger checksum # R: p+i+n+u+g+s+m+c+md5 # L: p+i+n+u+g # E: Empty group #>: Growing logfile p+u+g+i+n+S # haval: haval checksum # gost: gost checksum # crc32: crc32 checksum # This is the email address reports get mailed to # It's only used by the cron script and at the moment only the first address # specified in this manner will be used. @@define MAILTO root @@define LINES 1000 # Custom rules Binlib = p+i+n+u+g+s+b+m+c+md5+sha1 ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha1 Logs = p+i+n+u+g+S Devices = p+i+n+u+g+s+b+c+md5+sha1 Databases = p+n+u+g StaticDir = p+i+n+u+g ManPages = p+i+n+u+g+s+b+m+c+md5+sha1 # Next decide what directories/files you want in the database # Kernel, system map, etc. =/boot$ Binlib # Binaries /bin Binlib /sbin Binlib /usr/bin Binlib /usr/sbin Binlib /usr/local/bin Binlib /usr/local/sbin Binlib /usr/games Binlib # Libraries /lib Binlib /usr/lib Binlib /usr/local/lib Binlib # Log files /var/log$ StaticDir /var/log/aide/aide.log(.[0-9])?(.gz)? Databases /var/log/aide/error.log(.[0-9])?(.gz)? Databases /var/log/setuid.changes(.[0-9])?(.gz)? Databases /var/log Logs # Devices !/dev/pts /dev Devices # Other miscellaneous files /var/run$ StaticDir !/var/run # Test only the directory when dealing with /proc /proc$ StaticDir !/proc # You can look through these examples to get further ideas # MD5 sum files - especially useful with debsums -g #/var/lib/dpkg/info/([^\.]+).md5sums # Check crontabs #/var/spool/anacron/cron.daily Databases #/var/spool/anacron/cron.monthly Databases #/var/spool/anacron/cron.weekly Databases #/var/spool/cron Databases #/var/spool/cron/crontabs Databases # manpages can be trojaned, especially depending on *roff implementation #/usr/man ManPages #/usr/share/man ManPages #/usr/local/man ManPages # docs #/usr/doc ManPages #/usr/share/doc ManPages # check users' home directories #/home Binlib # check sources for modifications #/usr/src L #/usr/local/src L # Check headers for same #/usr/include L #/usr/local/include L
# aide --initCreates aide.db.new:
# cd /var/lib/aide (Your database location may differ) # ls aide.db.new # file * aide.db: gzip compressed data, from Unix # zcat aide.db.new | more @@begin_db # This file was generated by Aide, version 0.9 # Time of generation was 2003-11-07 16:26:35 @@db_spec name attr perm bcount uid gid size mtime ctime inode lcount md5 sha1 /boot 4029 40755 8 0 0 4096 MTA2NzUyOTY5NQ== MTA2NzUyOTY5NQ== 2 3 0 0 /bin 4029 40755 8 0 0 4096 MTA2NzUyOTU3NQ== MTA2NzUyOTU3NQ== 32577 2 0 0 /dev 3773 40755 40 0 0 20480 0 MTA2Nzk1NTM1Ng== 48865 6 0 0 /usr/sbin 4029 40755 16 0 0 8192 MTA2ODI1MTE5MQ== MTA2ODI1MTE5MQ== 846993 2 0 0 ... /bin/ed 16317 100755 80 0 0 39544 MTA0OTMwMDYzOA== MTA1NDA3MDA5NQ== 32855 1 90n0JdsR5vJ4U5mqWskUVw== S1Wx+mrBHcbdw9t+Un0PF8sMOMM= /bin/bash 16317 100755 1360 0 0 690668 MTA1NDk1OTQyNw== MTA1ODg5NjA2Mw== 35344 1 ovztEqp7trJ5paOaarLASA== y3v+hCAcp86Mw/wxi1fhHyvwTgw= /bin/rbash 4031 120777 0 0 0 4 MTA1ODg5NjA2Mw== MTA1ODg5NjA2Mw== 35345 1 0 0 /bin/sh 4031 120777 0 0 0 4 MTA1ODg5NjA2Mw== MTA1ODg5NjA2Mw== 34274 1 0 0 /bin/readlink 16317 100755 24 0 0 10360 MTA1ODAxODA4OA== MTA1OTE0MjE2Nw== 34467 1 pQaHvKzVjpC4cCVmWqUeQg== hj+69PH6b9VZEFsflyalW+W8Ubs= /bin/run-parts 16317 100755 24 0 0 10616 MTA2NzIxOTYwNA== MTA2NzUyOTI3MQ== 32655 1 WTSt4R41SKK2B2bpnPN3ow== 2y28N9Cr5G08U+Wo9AQB4x0UUFQ= /bin/tempfile 16317 100755 16 0 0 5620 MTA2NzIxOTYwNA== MTA2NzUyOTI3MQ== 32656 1 2YY6BdazHYqZb8lhEeCYEg== AJKN9iEpxhKn1iJhS3aOA6loKGg= /bin/mktemp 16317 100755 16 0 0 5576 MTA2NzIxOTYwNA== MTA2NzUyOTI3MQ== 32660 1 N AK9tgb9oQh4e2HN2qq11A== GtUULH2LoGSLtje3mwIo9hx2aBc= ...
Usage: aidecommand Commands: -i --init Initialize the database -C --check Check the database -u --update Check and update the database non-interactively. --compare Compare two databases -v --version Show version of AIDE and compilation options. Options: -c config_file --config=config_file Get config options from config_file. -B "config_stuff" --before="config_stuff" Before config_file is read use these options. -A "config_stuff" --after="config_stuff" After config_file is read use these options. -r reporter --report=reporter Where report output is written to. -Vverbosity_level --verbose=verbosity_level Level of debug messages. --config-check just read config-file
AIDE found differences between database and filesystem!! Start timestamp: 2003-11-07 19:08:30 Summary: Total number of files=21623,added files=3,removed files=1,changed files=8 Added files: added:/bin/xnmap added:/etc/ssh/shosts.equiv Changed files: changed:/bin changed:/bin/ls changed:/bin/tar changed:/bin/login changed:/var/log/messages changed:/var/log/messages.0 changed:/var/log/messages.1.gz Detailed information about changes: Directory: /bin Mtime : 2003-10-30 07:59:35 , 2003-11-07 19:07:39 Ctime : 2003-10-30 07:59:35 , 2003-11-07 19:07:39 File: /bin/ls Mtime : 2003-07-12 06:54:48 , 2003-11-07 19:38:14 Ctime : 2003-07-25 07:09:27 , 2003-11-07 19:38:14 Inode : 34462 , 34474 File: /bin/login Size : 24344 , 9752 Bcount : 48 , 24 Mtime : 2003-07-12 06:54:48 , 2003-11-08 08:01:02 Ctime : 2003-07-25 07:09:27 , 2003-11-08 08:01:02 Inode : 34474 , 34128 MD5 : qzgOxSxn04F3dfUU9xNz8w== , DdkmJmlKHA9CvqA56TSa9g== SHA1 : NxdYCHBCC5Ud4dshxGd4OI/YtLQ= , JTyIuhywUow2wuZFclC8jlu8Gw0= File: /bin/tar Permissions: -rwxr-xr-x , -rwsr-xr-x Ctime : 2003-10-07 08:38:00 , 2003-11-07 19:23:55 File: /var/log/messages.1.gz Inode : 961027 , 961107 File: /var/log/messages.0 Inode : 961074 , 961081 File: /var/log/messages Inode : 961108 , 961074
# ls -l /var/lib/aide
-rwx------ 2 root root 4096 Nov 6 10:10 RCS
-rw------- 1 root root 1260516 Nov 7 16:40 aide.db
-rw------- 1 root root 1260611 Nov 7 19:12 aide.db.new
# mv aide.db.new aide.db
# ci -u aide.db
(Assumes you checked it out already.)
(Works best when you don't gzip output.)