Configuration and setting-up of AIDE on RHEL6

AIDE is a powerful package for checking integrity of files on a machine/system.

Prerequisites: Just aide package.

[root@sunny ~]# yum install aide -y

Loaded plugins: refresh-packagekit, rhnplugin

This system is not registered with RHN.                                                                        

RHN support will be disabled.

Setting up Install Process

Resolving Dependencies

--> Running transaction check

---> Package aide.x86_64 0:0.14-3.el6 set to be updated

--> Finished Dependency Resolution

Dependencies Resolved

================================================================================

 Package         Arch              Version               Repository        Size

================================================================================

Installing:

 aide            x86_64            0.14-3.el6            local            123 k

Transaction Summary

================================================================================

Install       1 Package(s)

Upgrade       0 Package(s)

Total download size: 123 k

Installed size: 297 k

Downloading Packages:

aide-0.14-3.el6.x86_64.rpm                               | 123 kB     00:00    

Running rpm_check_debug

Running Transaction Test

Transaction Test Succeeded

Running Transaction

  Installing     : aide-0.14-3.el6.x86_64                                   1/1

Installed:

  aide.x86_64 0:0.14-3.el6    

                                                

Complete!

[root@sunny ~]#

Main configuration file for this aide is /etc/aide.conf, This file contains:

·         Default path of DBDIR,

·         LOGDIR,

·         From where the DB needs to be read,

·         Where the new DB needs to be created,

·         Which directories you need to include when you run a check od initialize a DB via aide,

·         And  various other things.

Now for getting started with aide firstly we need to initialize this:

[root@sunny ~]# /usr/sbin/aide --init

OR

[root@sunny ~]# aide --init

Once your aide it initialized it will show you a message and the path of your new database.

=============================

AIDE, version 0.14

### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

============================

So the database which is present on location /var/lib/aide/aide.db.new.gz, /usr/sbin/aide and /etc/aide.conf are very critical you need to save all these files to a safe location, Like as the conf. file contains everything and the DB which you just created created information about your machine before any changes have been made.

The expected name of the DB which aide can read from is aide.db.gz which should be there in /var/lib/aide/ directory, Like the full path would be: /var/lib/aide/aide.db.gz.

Now suppose that some changes are made in the machine in which aide was initialized, Like vsftpd was installed.

Now we need to check whether there is any inconsistency between the database and the machine or not ?

[root@client aide]# aide --check

You can check the differences in the DB in aide.log file like which files were changed, removed, total number of files etc.

The default layout for aide.log file is as follows:

==================================

AIDE found differences between database and filesystem!!

Start timestamp: 2012-08-21 12:31:49

Summary:

  Total number of files:        118342

  Added files:                  0

  Removed files:                2

  Changed files:                177

---------------------------------------------------

Removed files:

---------------------------------------------------

removed: /var/log/nagios/spool/checkresults/cbIBh8r

removed: /var/log/nagios/spool/checkresults/cbIBh8r.ok

---------------------------------------------------

Changed files:

---------------------------------------------------

changed: /etc/vsftpd

changed: /etc/vsftpd/ftpusers

Followed by a long list of files which were changed.

==================================

If the changes are know then you can update your DB if not then you can take actions as required and again save that DB to a safe location.

[root@client]# aide --update