Learning Academy

The Cure of Ignorance is to Question. MUHAMMAD (PBUH)

CentOS

How to install AIDE on CentOS


Configuration:

1)   Customizing Conf File:

Customize /etc/aide.conf to your liking.

you@yourmachine ~] vi /etc/aide.conf

Here is an example configuration.
#AIDE conf

# Here are all the things we can check – these are the default rules
#
#p:      permissions
#i:      inode
#n:      number of links
#l:      link name
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#I:      ignore changed filename
#md5:    md5 checksum
#sha1:   sha1 checksum
#sha256: sha256 checksum
#sha512: sha512 checksum
#rmd160: rmd160 checksum
#tiger:  tiger checksum
#haval:  haval checksum
#crc32:  crc32 checksum
#R:      p+i+l+n+u+g+s+m+c+acl+selinux+xattrs+md5
#L:      p+i+l+n+u+g+acl+selinux+xattrs
#E:      Empty group
#>:      Growing logfile p+l+u+g+i+n+S+acl+selinux+xattrs
#The following are available if you have mhash support enabled:
#gost:   gost checksum
#whirlpool: whirlpool checksum
#The following are available when explicitly enabled using configure:
#acl:    access control list
#selinux SELinux security context
#xattr:  extended file attributes

# You can alse create custom rules – my home made rule definition goes like this
#
MyRule = p+i+n+u+g+s+b+m+c+md5+sha1

# Next decide what directories/files you want in the database

/etc p+i+u+g     #check only permissions, inode, user and group for etc
/bin MyRule      # apply the custom rule to the files in bin
/sbin MyRule     # apply the same custom rule to the files in sbin
/var MyRule       
!/var/log/.*     # ignore the log dir it changes too often
!/var/spool/.*   # ignore spool dirs as they change too often
!/var/adm/utmp$  # ignore the file /var/adm/utmp

In particular, add important directories and files which you would like to be covered by integrity checks. Avoid files which are expected to change frequently or which don’t affect the safety of your system.

Muhammad Shaukat

Content Developer at LearnAcad.com

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Pin It on Pinterest