Manivel: January 2014

AIDE stands for Advance Intrustion Detection Environment. AIDE is a file and directory integrity checker.

AIDE Installation

I installed aide using yum command

[root@mail-server ~]# yum install aide

Loaded plugins: fastestmirror, security
Loading mirror speeds from cached hostfile
epel/metalink                                            | 5.4 kB     00:00
* base: mirrors.kernel.org
* epel: mirrors.vinahost.vn
* extras: centosg4.centos.org
* updates: centosi3.centos.org
base                                                                                                                                             | 3.7 kB     00:00
extras                                                                                                                                           | 3.4 kB     00:00
updates                                                                                                                                          | 3.4 kB     00:00
updates/primary_db                                                                                                                               | 1.4 MB     00:07
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package aide.x86_64 0:0.14-3.el6_2.2 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================================================
Package                              Arch                                   Version                                         Repository                            Size
========================================================================================================================================================================
Installing:
aide                                 x86_64                                 0.14-3.el6_2.2                                  base                                 123 k

Transaction Summary
========================================================================================================================================================================
Install       1 Package(s)

Total download size: 123 k
Installed size: 297 k
Is this ok [y/N]: y
Downloading Packages:aide-0.14-3.el6_2.2.x86_64.rpm                                                                                                                   | 123 kB     00:01
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : aide-0.14-3.el6_2.2.x86_64                                                                                                                           1/1
Verifying : aide-0.14-3.el6_2.2.x86_64                                                                                                                           1/1

Installed:
aide.x86_64 0:0.14-3.el6_2.2

Complete!
[root@mail-server ~]#

Otherwise you can download and Install from this link http://sourceforge.net/projects/aide/files/latest/download

Configuration

I copped aide.conf for testing purpose from main configuration file /etc/aide.conf

[root@mail-server ~]# cp /etc/aide.conf /root/

[root@mail-server ~]# cat /root/aide.conf

# Example configuration file for AIDE.

@@define DBDIR /var/lib/aide ----> This is the Database directory (you can change the directory path )
@@define LOGDIR /var/log/aide
----> This is the Log directory (you can change the log path )

# The location of the database to be read.
database=file:@@{DBDIR}/aide.db.gz

# The location of the database to be written. #database_out=sql:host:port:database:login_name:passwd:table
#database_out=file:aide.db.new

database_out=file:@@{DBDIR}/aide.db.new.gz

# Whether to gzip the output to database
gzip_dbout=yes

# Default.
verbose=5

report_url=file:@@{LOGDIR}/aide.log
report_url=stdout
#report_url=stderr
#NOT IMPLEMENTED report_url=mailto:root@foo.com
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH

# These are the default rules.
#
#p:      permissions
#i:      inode:
#n:      number of links
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#acl:           Access Control Lists
#selinux        SELinux security context
#xattrs:        Extended file attributes
#md5:    md5 checksum
#sha1:   sha1 checksum
#sha256:        sha256 checksum
#sha512:        sha512 checksum
#rmd160: rmd160 checksum
#tiger: tiger checksum

#haval: haval checksum (MHASH only)
#gost:   gost checksum (MHASH only)
#crc32: crc32 checksum (MHASH only)
#whirlpool:     whirlpool checksum (MHASH only)

#R:             p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
#L:             p+i+n+u+g+acl+selinux+xattrs
#E:             Empty group
#>:             Growing logfile p+u+g+i+n+S+acl+selinux+xattrs

# You can create custom rules like this.
# With MHASH...
# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
# Everything but access time (Ie. all changes)
EVERYTHING = R+ALLXTRAHASHES

# Sane, with multiple hashes
# NORMAL = R+rmd160+sha256+whirlpool
NORMAL = R+rmd160+sha256

# For directories, don't bother doing hashes
DIR = p+i+n+u+g+acl+selinux+xattrs

# Access control only
PERMS = p+i+u+g+acl+selinux

# Logfile are special, in that they often change
LOG = >

# Just do md5 and sha256 hashes
LSPP = R+sha256

# Some files get updated automatically, so the inode/ctime/mtime change
# but we want to know when the data inside them changes
DATAONLY = p+n+u+g+s+acl+selinux+xattrs+md5+sha256+rmd160+tiger

# Next decide what directories/files you want in the database.

# I removed all the below rules. I added only /etc directory

/etc NORMAL

:wq

I initialized the AIDE database using below command

[root@mail-server ~]# aide --init --config=/root/aide.conf

AIDE, version 0.14

### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

[root@mail-server ~]#
Then copy the first time initialized database because next time aide to be read this database.

[root@mail-server ~]# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

/var/lib/aide/aide.db.new.gz ---> AIDE to be written

/var/lib/aide/aide.db.gz ---> AIDE to be read

First time AIDE checking

[root@mail-server ~]# aide -c /root/aide.conf --check

AIDE, version 0.14

### All files match AIDE database. Looks okay!

[root@mail-server ~]#

Now i created one file inside /etc directory for testing

[root@mail-server ~]# touch /etc/test.txt

I checked AIDE next time.It gave the created file details.It is like below

[root@mail-server ~]# aide -c /root/aide.conf --check

AIDE found differences between database and filesystem!!
Start timestamp: 2014-01-29 23:08:25

Summary:
Total number of files:    2079
Added files:            0
Removed files:        0
Changed files:        1
---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/test.txt

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /etc/test.txt
Mtime : 2014-01-29 22:32:36 , 2014-01-29 23:08:20
Ctime : 2014-01-29 22:32:36 , 2014-01-29 23:08:20
[root@mail-server ~]#

Manivel

Wednesday, 29 January 2014

AIDE Installation and Configuration on Centos

Thursday, 23 January 2014

Another MySQL daemon already running with the same unix socket. mysqld failed

Wednesday, 22 January 2014

Understanding linux commands

Sunday, 12 January 2014

Ignore a specific alert for specific IP address in Snort