Isntall aide service to audit linux OS.

1. Install aide software.
[root@server7-5499 ~]# yum install aide -y

2. Modify aide configuration file.
Basic cofigrations:
# Define DB/Log location.
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide

# Define DB location and name.
database=file:@@{DBDIR}/aide.db.gz
database_out=file:@@{DBDIR}/aide.db.new.gz

# Compress aide DB.
gzip_dbout=yes

verbose=5

# Define generate report write into logs and print in screen.
report_url=file:@@{LOGDIR}/aide.log
report_url=stdout

# Define dirs which you want to audit.
# Next decide what directories/files you want in the database.
/boot   NORMAL
/bin    NORMAL
/sbin   NORMAL
#/lib    NORMAL
#/lib64  NORMAL
#/opt    NORMAL
#/usr    NORMAL
/root   NORMAL
# These are too volatile
!/usr/src
!/usr/tmp

3. After cofnigured aide, generate aide DB.
[root@server7-5499 ~]# aide -i

AIDE, version 0.14

### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

4. Rename DB to var/lib/aide/aide.db.gz.
[root@server7-5499 ~]# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Generate report with exist DB.


5.Check report.

[root@server7-5499 ~]# aide -C

AIDE, version 0.14

### All files match AIDE database. Looks okay!

6. Change something to verify.
a. Add user user2.
[root@server7-5499 ~]# useradd -u 10004 -s /sbin/nologin user2

b. Check changes.
[root@server7-5499 ~]# aide -C
AIDE found differences between database and filesystem!!
Start timestamp: 2015-04-17 04:16:51

Summary:
  Total number of files:    1815
  Added files:            1
  Removed files:        0
  Changed files:        11


---------------------------------------------------
Added files:
---------------------------------------------------

added: /var/log/httpd/access_log-20150417

---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/passwd
changed: /etc/passwd-
changed: /etc/gshadow
changed: /etc/gshadow-
changed: /etc/group-
changed: /etc/shadow-
changed: /etc/shadow
changed: /etc/group
changed: /var/log/httpd/access_log
changed: /root
changed: /root/.viminfo

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /etc/passwd
  Size     : 1339                             , 1386
  Mtime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Inode    : 25609                            , 25599
  MD5      : d+FKjnPVooobLRWIOQVHNQ==         , MvDGwK3/gRL50jgog6EACQ==
  RMD160   : 8YG5pF836arLZv21lTV+yqy2168=     , VSNqhtinLe/sr8uXAYyA0oR+fSs=
  SHA256   : INjoll/4rmfwEsOYToLMeNBJ8L/mfUxQ , tCOa5LDpBxfTfdCmbc8sbQkdcJCbFg1W

File: /etc/passwd-
  Size     : 1294                             , 1339
  Mtime    : 2015-04-03 02:27:33              , 2015-04-17 02:09:33
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  MD5      : /00yqCUwzu/+80x3VOAuJg==         , d+FKjnPVooobLRWIOQVHNQ==
  RMD160   : rZODe9EDMan8u2ZqGWimvk2bLvw=     , 8YG5pF836arLZv21lTV+yqy2168=
  SHA256   : 7IVctSIG7Qw5zYavDOlFqAtDJrDGnklQ , INjoll/4rmfwEsOYToLMeNBJ8L/mfUxQ

File: /etc/gshadow
  Size     : 498                              , 508
  Mtime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Inode    : 25534                            , 25311
  MD5      : L6+T3NkFFkABarfcq2c4CQ==         , T1TJBYLW6bOfDXRmlGa6gg==
  RMD160   : DpgU5yThE0X5w7okjgWxuwHqzXA=     , ibpE8mR6MV+8w7Voifbo4bzbxR8=
  SHA256   : mT0lKR8rEv7aevcdmx8EJiFrppYNmXzD , zlbrYjEj+lFUR7ZVkcpBbgpv2GS6S/W6

File: /etc/gshadow-
  Size     : 488                              , 498
  Mtime    : 2015-04-03 02:27:33              , 2015-04-17 02:09:33
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  MD5      : 6jpjE5dvxH/QyhmmkGPtfQ==         , L6+T3NkFFkABarfcq2c4CQ==
  RMD160   : BN7h6wDeG9Xyj07tJOinZUqt6+w=     , DpgU5yThE0X5w7okjgWxuwHqzXA=
  SHA256   : M1AdyyijKDEbD7jlHgzqHP6MD+53iGMg , mT0lKR8rEv7aevcdmx8EJiFrppYNmXzD

File: /etc/group-
  Size     : 594                              , 608
  Mtime    : 2015-04-03 02:27:33              , 2015-04-17 02:09:33
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  MD5      : WrPAJ/80hAgvRGRPk6bDXg==         , XhF8M1FnvxQV01xWfQvtzA==
  RMD160   : mBJff/Xi0fN2bmekHpuz9gJOItg=     , JWBfvVU6VslOSv7ED7kh0cDM6Wg=
  SHA256   : QFlMvKnLkOEBiMyxvlwgQbrIDxkWzAL4 , s/36GkNID/mhdjANgxx5v2h82/XS17/C

File: /etc/shadow-
  Size     : 723                              , 751
  Mtime    : 2015-04-03 02:27:33              , 2015-04-17 02:09:33
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  MD5      : A8Zb/ckBsHBtsk8mq76zxQ==         , 3aUQZa/Rm4M2dM2OCuki8w==
  RMD160   : ZlrkTM5D1FApq0jzXOMzJAj8f/Y=     , 9pLx0kdQ2xUXHoyna9DL5DFMAeM=
  SHA256   : iiOhA9Tmtq486nMVSKvFO0QluRkAnilR , 3KETpurrzpBFAMBqeY8ieDscEpL9X9Fu

File: /etc/shadow
  Size     : 751                              , 779
  Mtime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Inode    : 25536                            , 25602
  MD5      : 3aUQZa/Rm4M2dM2OCuki8w==         , 4sl4OTMZdUxLFy8F5o1MIQ==
  RMD160   : 9pLx0kdQ2xUXHoyna9DL5DFMAeM=     , mrOgJ9i5zr2adGqFXHNVsnszQrg=
  SHA256   : 3KETpurrzpBFAMBqeY8ieDscEpL9X9Fu , Uf0sxciwL16vT0plQeWLS8Kltd93F64t

File: /etc/group
  Size     : 608                              , 623
  Mtime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Ctime    : 2015-04-17 02:09:33              , 2015-04-17 04:16:22
  Inode    : 25311                            , 25536
  MD5      : XhF8M1FnvxQV01xWfQvtzA==         , jLMJugOfdQRDiiqFvUUSBg==
  RMD160   : JWBfvVU6VslOSv7ED7kh0cDM6Wg=     , MY2+zs+5bSFXKOddHkDBxanlunY=
  SHA256   : s/36GkNID/mhdjANgxx5v2h82/XS17/C , NjUENRSrdD7bg31irex1ME7YWZHidVPK

File: /var/log/httpd/access_log
  Size     : 730                              , 0
  Inode    : 266417                           , 266453

Directory: /root
  Mtime    : 2015-04-17 04:05:56              , 2015-04-17 04:15:20
  Ctime    : 2015-04-17 04:05:56              , 2015-04-17 04:15:20

File: /root/.viminfo
  Inode    : 25306                            , 25269
[root@server7-5499 ~]#

郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。