blob: 519fc671c1751a2e501b15d5b5f6b3a9a2fe4448 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
|
# Example configuration file for AIDE.
# More information about configuration options available in the aide.conf manpage.
# Inspired from https://src.fedoraproject.org/rpms/aide/raw/rawhide/f/aide.conf
# ┌───────────────────────────────────────────────────────────────┐
# │ CONTENTS OF aide.conf │
# ├───────────────────────────────────────────────────────────────┘
# │
# ├──┐VARIABLES
# │ ├── DATABASE
# │ └── REPORT
# ├──┐RULES
# │ ├── LIST OF ATTRIBUTES
# │ ├── LIST OF CHECKSUMS
# │ └── AVAILABLE RULES
# ├──┐PATHS
# │ ├──┐EXCLUDED
# │ │ ├── ETC
# │ │ ├── USR
# │ │ └── VAR
# │ └──┐INCLUDED
# │ ├── ETC
# │ ├── USR
# │ ├── VAR
# │ └── OTHERS
# │
# └───────────────────────────────────────────────────────────────
# ################################################################ VARIABLES
# ################################ DATABASE
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide
# The location of the database to be read.
database_in=file:@@{DBDIR}/aide.db.gz
# The location of the database to be written.
#database_out=sql:host:port:database:login_name:passwd:table
#database_out=file:aide.db.new
database_out=file:@@{DBDIR}/aide.db.new.gz
# Whether to gzip the output to database
gzip_dbout=yes
# ################################ REPORT
# Default.
log_level=warning
report_level=changed_attributes
report_url=file:@@{LOGDIR}/aide.log
report_url=stdout
#report_url=stderr
#NOT IMPLEMENTED report_url=mailto:root@foo.com
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
# ################################################################ RULES
# ################################ LIST OF ATTRIBUTES
# These are the default parameters we can check against.
#p: permissions
#i: inode:
#n: number of links
#u: user
#g: group
#s: size
#b: block count
#m: mtime
#a: atime
#c: ctime
#S: check for growing size
#acl: Access Control Lists
#selinux SELinux security context (must be enabled at compilation time)
#xattrs: Extended file attributes
# ################################ LIST OF CHECKSUMS
#md5: md5 checksum
#sha1: sha1 checksum
#sha256: sha256 checksum
#sha512: sha512 checksum
#rmd160: rmd160 checksum
#tiger: tiger checksum
#haval: haval checksum (MHASH only)
#gost: gost checksum (MHASH only)
#crc32: crc32 checksum (MHASH only)
#whirlpool: whirlpool checksum (MHASH only)
# ################################ AVAILABLE RULES
# These are the default rules
#R: p+i+l+n+u+g+s+m+c+md5
#L: p+i+l+n+u+g
#E: Empty group
#>: Growing logfile p+l+u+g+i+n+S
# You can create custom rules - my home made rule definition goes like this
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
# Everything but access time (Ie. all changes)
EVERYTHING = R+ALLXTRAHASHES
# Sane, with multiple hashes
# NORMAL = R+rmd160+sha256+whirlpool
# NORMAL = R+sha256+sha512
NORMAL = p+i+l+n+u+g+s+m+c+sha256
# For directories, don't bother doing hashes
DIR = p+i+n+u+g+acl+xattrs
# Access control only
PERMS = p+i+u+g+acl
# Logfile are special, in that they often change
LOG = >
# Just do sha256 and sha512 hashes
FIPSR = p+i+n+u+g+s+m+c+acl+xattrs+sha256
LSPP = FIPSR+sha512
# Some files get updated automatically, so the inode/ctime/mtime change
# but we want to know when the data inside them changes
DATAONLY = p+n+u+g+s+acl+xattrs+sha256
# ################################################################ PATHS
# Next decide what directories/files you want in the database.
# ################################ EXCLUDED
# ################ ETC
# Ignore backup files
!/etc/.*~
# Ignore mtab
!/etc/mtab
# ################ USR
# These are too volatile
!/usr/src
!/usr/tmp
# ################ VAR
# Ignore logs
!/var/lib/pacman/.*
!/var/cache/.*
!/var/log/.*
!/var/log/aide.log
!/var/run/.*
!/var/spool/.*
# ################################ INCLUDED
# ################ ETC
# Check only permissions, inode, user and group for /etc, but cover some important files closely.
/etc PERMS
/etc/aliases FIPSR
/etc/at.allow FIPSR
/etc/at.deny FIPSR
/etc/audit/ FIPSR
/etc/bash_completion.d/ NORMAL
/etc/bashrc NORMAL
/etc/cron.allow FIPSR
/etc/cron.daily/ FIPSR
/etc/cron.deny FIPSR
/etc/cron.d/ FIPSR
/etc/cron.hourly/ FIPSR
/etc/cron.monthly/ FIPSR
/etc/crontab FIPSR
/etc/cron.weekly/ FIPSR
/etc/cups FIPSR
/etc/exports NORMAL
/etc/fstab NORMAL
/etc/group NORMAL
/etc/grub/ FIPSR
/etc/gshadow NORMAL
/etc/hosts.allow NORMAL
/etc/hosts.deny NORMAL
/etc/hosts FIPSR
/etc/inittab FIPSR
/etc/issue FIPSR
/etc/issue.net FIPSR
/etc/ld.so.conf FIPSR
/etc/libaudit.conf FIPSR
/etc/localtime FIPSR
/etc/login.defs FIPSR
/etc/login.defs NORMAL
/etc/logrotate.d NORMAL
/etc/modprobe.conf FIPSR
/etc/nscd.conf NORMAL
/etc/pam.d FIPSR
/etc/passwd NORMAL
/etc/postfix FIPSR
/etc/profile.d/ NORMAL
/etc/profile NORMAL
/etc/rc.d FIPSR
/etc/resolv.conf DATAONLY
/etc/securetty FIPSR
/etc/securetty NORMAL
/etc/security FIPSR
/etc/security/opasswd NORMAL
/etc/shadow NORMAL
/etc/skel NORMAL
/etc/ssh/ssh_config FIPSR
/etc/ssh/sshd_config FIPSR
/etc/stunnel FIPSR
/etc/sudoers NORMAL
/etc/sysconfig FIPSR
/etc/sysctl.conf FIPSR
/etc/vsftpd.ftpusers FIPSR
/etc/vsftpd FIPSR
/etc/X11/ NORMAL
/etc/zlogin NORMAL
/etc/zlogout NORMAL
/etc/zprofile NORMAL
/etc/zshrc NORMAL
# ################ USR
/usr NORMAL
/usr/sbin/stunnel FIPSR
# ################ VAR
/var/log/faillog FIPSR
/var/log/lastlog FIPSR
/var/spool/at FIPSR
/var/spool/cron/root FIPSR
# ################ OTHERS
/boot NORMAL
/bin NORMAL
/lib NORMAL
/lib64 NORMAL
/opt NORMAL
/root NORMAL
|