|
 |
bc4ae4 |
# Example configuration file for AIDE.
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
@@define DBDIR /var/lib/aide
|
|
|
bc4ae4 |
@@define LOGDIR /var/log/aide
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# The location of the database to be read.
|
|
|
bc4ae4 |
database=file:@@{DBDIR}/aide.db.gz
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# The location of the database to be written.
|
|
|
bc4ae4 |
#database_out=sql:host:port:database:login_name:passwd:table
|
|
|
bc4ae4 |
#database_out=file:aide.db.new
|
|
|
bc4ae4 |
database_out=file:@@{DBDIR}/aide.db.new.gz
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Whether to gzip the output to database.
|
|
|
bc4ae4 |
gzip_dbout=yes
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Default.
|
|
|
bc4ae4 |
verbose=5
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
report_url=file:@@{LOGDIR}/aide.log
|
|
|
bc4ae4 |
report_url=stdout
|
|
|
bc4ae4 |
#report_url=stderr
|
|
|
bc4ae4 |
#NOT IMPLEMENTED report_url=mailto:root@foo.com
|
|
|
bc4ae4 |
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# These are the default rules.
|
|
|
bc4ae4 |
#
|
|
|
bc4ae4 |
#p: permissions
|
|
|
bc4ae4 |
#i: inode:
|
|
|
bc4ae4 |
#n: number of links
|
|
|
bc4ae4 |
#u: user
|
|
|
bc4ae4 |
#g: group
|
|
|
bc4ae4 |
#s: size
|
|
|
bc4ae4 |
#b: block count
|
|
|
bc4ae4 |
#m: mtime
|
|
|
bc4ae4 |
#a: atime
|
|
|
bc4ae4 |
#c: ctime
|
|
|
bc4ae4 |
#S: check for growing size
|
|
|
bc4ae4 |
#acl: Access Control Lists
|
|
|
bc4ae4 |
#selinux SELinux security context
|
|
|
bc4ae4 |
#xattrs: Extended file attributes
|
|
|
bc4ae4 |
#md5: md5 checksum
|
|
|
bc4ae4 |
#sha1: sha1 checksum
|
|
|
bc4ae4 |
#sha256: sha256 checksum
|
|
|
bc4ae4 |
#sha512: sha512 checksum
|
|
|
bc4ae4 |
#rmd160: rmd160 checksum
|
|
|
bc4ae4 |
#tiger: tiger checksum
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
#haval: haval checksum (MHASH only)
|
|
|
bc4ae4 |
#gost: gost checksum (MHASH only)
|
|
|
bc4ae4 |
#crc32: crc32 checksum (MHASH only)
|
|
|
bc4ae4 |
#whirlpool: whirlpool checksum (MHASH only)
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
#R: p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
|
|
|
bc4ae4 |
#L: p+i+n+u+g+acl+selinux+xattrs
|
|
|
bc4ae4 |
#E: Empty group
|
|
|
bc4ae4 |
#>: Growing logfile p+u+g+i+n+S+acl+selinux+xattrs
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# You can create custom rules like this.
|
|
|
bc4ae4 |
# With MHASH...
|
|
|
bc4ae4 |
# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
|
|
|
bc4ae4 |
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Everything but access time (Ie. all changes)
|
|
|
bc4ae4 |
EVERYTHING = R+ALLXTRAHASHES
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Sane, with one good hash.
|
|
|
bc4ae4 |
# NORMAL = sha256
|
|
|
bc4ae4 |
NORMAL = sha256
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# For directories, don't bother doing hashes.
|
|
|
bc4ae4 |
DIR = p+i+n+u+g+acl+selinux+xattrs
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Access control only.
|
|
|
bc4ae4 |
PERMS = p+u+g+acl+selinux+xattrs
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Access + inode changes + file type.
|
|
|
bc4ae4 |
STATIC = p+u+g+acl+selinux+xattrs+i+n+b+c+ftype
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Logfiles only check access w/o xattrs.
|
|
|
bc4ae4 |
LOG = p+u+g+n+acl+selinux+ftype
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Content + file type.
|
|
|
bc4ae4 |
CONTENT = sha256+ftype
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Extended content + file type + access.
|
|
|
bc4ae4 |
CONTENT_EX = sha256+ftype+p+u+g+n+acl+selinux+xattrs
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Some files get updated automatically, so the inode/ctime/mtime change
|
|
|
bc4ae4 |
# but we want to know when the data inside them changes.
|
|
|
bc4ae4 |
DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha256
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Next decide what directories/files you want in the database. Aide
|
|
|
bc4ae4 |
# uses a first match system. Put file specific instructions before generic
|
|
|
bc4ae4 |
# matches. e.g. Put file matches before directories.
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
/boot/ CONTENT_EX
|
|
|
bc4ae4 |
/bin/ CONTENT_EX
|
|
|
bc4ae4 |
/sbin/ CONTENT_EX
|
|
|
bc4ae4 |
/lib/ CONTENT_EX
|
|
|
bc4ae4 |
/lib64/ CONTENT_EX
|
|
|
bc4ae4 |
/opt/ CONTENT
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Admin's dot files constantly change, just check perms.
|
|
|
bc4ae4 |
/root/\..* PERMS
|
|
|
bc4ae4 |
# Otherwise get all of /root.
|
|
|
bc4ae4 |
/root/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# These are too volatile.
|
|
|
bc4ae4 |
!/usr/src/
|
|
|
bc4ae4 |
!/usr/tmp/
|
|
|
bc4ae4 |
# Otherwise get all of /usr.
|
|
|
bc4ae4 |
/usr/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Check only permissions, user, group, seliunx for /etc, but
|
|
|
bc4ae4 |
# cover some important files closely.
|
|
|
bc4ae4 |
!/etc/mtab$
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Ignore backup files
|
|
|
bc4ae4 |
!/etc/.*~
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# trusted databases
|
|
|
bc4ae4 |
/etc/hosts$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/host.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/hostname$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/issue$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/issue.net$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/protocols$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/services$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/localtime$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/alternatives/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/mime.types$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/terminfo/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/exports$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/fstab$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/passwd$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/group$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/gshadow$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/shadow$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/security/opasswd$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/skel/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# networking
|
|
|
bc4ae4 |
/etc/hosts.allow$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/hosts.deny$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/firewalld/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/NetworkManager/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/networks$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/dhcp/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/wpa_supplicant/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/resolv.conf$ DATAONLY
|
|
|
bc4ae4 |
/etc/nscd.conf$ NORMAL
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# logins and accounts
|
|
|
bc4ae4 |
/etc/login.defs$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/libuser.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/var/log/faillog$ PERMS
|
|
|
bc4ae4 |
/var/log/lastlog$ PERMS
|
|
|
bc4ae4 |
/var/run/faillock/ PERMS
|
|
|
bc4ae4 |
/etc/pam.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/security$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/securetty$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/polkit-1/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/sudo.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/sudoers$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/sudoers.d/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Shell/X starting files
|
|
|
bc4ae4 |
/etc/profile$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/profile.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/bashrc$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/bash_completion.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/zprofile$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/zshrc$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/zlogin$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/zlogout$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/X11/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/shells$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Pkg manager
|
|
|
bc4ae4 |
/etc/yum.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/yumex.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/yumex.profiles.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/yum/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/yum.repos.d/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# This gets new/removes-old filenames daily.
|
|
|
bc4ae4 |
!/var/log/sa/
|
|
|
bc4ae4 |
# As we are checking it, we've truncated yesterdays size to zero.
|
|
|
bc4ae4 |
!/var/log/aide.log
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# auditing
|
|
|
bc4ae4 |
# AIDE produces an audit record, so this becomes perpetual motion.
|
|
|
bc4ae4 |
# /var/log/audit/ PERMS+ANF+ARF
|
|
|
bc4ae4 |
/etc/audit/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/audisp/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/libaudit.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/aide.conf$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# System logs
|
|
|
bc4ae4 |
/etc/rsyslog.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/rsyslog.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/logrotate.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/logrotate.d/ CONTENT_EX
|
|
|
bc4ae4 |
/var/log/ LOG+ANF+ARF
|
|
|
bc4ae4 |
/var/run/utmp$ LOG
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# secrets
|
|
|
bc4ae4 |
/etc/pkcs11/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/pki/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/ssl/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/certmonger/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# init system
|
|
|
bc4ae4 |
/etc/systemd/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/sysconfig/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/rc.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/tmpfiles.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/machine-id$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# boot config
|
|
|
bc4ae4 |
/etc/grub.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/grub2.cfg$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/dracut.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/dracut.conf.d/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# glibc linker
|
|
|
bc4ae4 |
/etc/ld.so.cache$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/ld.so.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/ld.so.conf.d/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# kernel config
|
|
|
bc4ae4 |
/etc/sysctl.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/sysctl.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/modprobe.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/modules-load.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/depmod.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/udev/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/crypttab$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
#### Daemons ####
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# cron jobs
|
|
|
bc4ae4 |
/var/spool/at/ CONTENT
|
|
|
bc4ae4 |
/etc/at.allow$ CONTENT
|
|
|
bc4ae4 |
/etc/at.deny$ CONTENT
|
|
|
bc4ae4 |
/etc/cron.allow$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.deny$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.d/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.daily/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.hourly/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.monthly/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cron.weekly/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/crontab$ CONTENT_EX
|
|
|
bc4ae4 |
/var/spool/cron/root/ CONTENT
|
|
|
bc4ae4 |
/etc/anacrontab$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# time keeping
|
|
|
bc4ae4 |
/etc/ntp.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/ntp/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/chrony.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/chrony.keys$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# mail
|
|
|
bc4ae4 |
/etc/aliases$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/aliases.db$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/postfix/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/mail.rc$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/mailcap$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# ssh
|
|
|
bc4ae4 |
/etc/ssh/sshd_config$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/ssh/ssh_config$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# stunnel
|
|
|
bc4ae4 |
/etc/stunnel/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# ftp
|
|
|
bc4ae4 |
/etc/vsftpd.conf$ CONTENT
|
|
|
bc4ae4 |
/etc/vsftpd/ CONTENT
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# printing
|
|
|
bc4ae4 |
/etc/cups/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/cupshelpers/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/avahi/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# web server
|
|
|
bc4ae4 |
/etc/httpd/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# dns
|
|
|
bc4ae4 |
/etc/named/ CONTENT_EX
|
|
|
bc4ae4 |
/etc/named.conf$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/named.iscdlv.key$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/named.rfc1912.zones$ CONTENT_EX
|
|
|
bc4ae4 |
/etc/named.root.key$ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# xinetd
|
|
|
bc4ae4 |
/etc/xinetd.d/ CONTENT_EX
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Now everything else in /etc.
|
|
|
bc4ae4 |
/etc/ PERMS
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# With AIDE's default verbosity level of 5, these would give lots of
|
|
|
bc4ae4 |
# warnings upon tree traversal. It might change with future version.
|
|
|
bc4ae4 |
#
|
|
|
bc4ae4 |
#=/lost\+found DIR
|
|
|
bc4ae4 |
#=/home DIR
|
|
|
bc4ae4 |
|
|
|
bc4ae4 |
# Ditto /var/log/sa/ same reason...
|
|
|
bc4ae4 |
!/var/log/httpd/
|