AIDE to the Rescue -- An Open Source Security Tool
By Arthur Messenger, February 06, 2003
The Advanced Intrusion Detection System (AIDE) is a multiple platform, open source, and GPL replacement for Tripwire. Both tools monitor system intrusions by building an initial database and doing file integrity checks against that database. AIDE came about because the original author Rami Lehti wanted to get past some of Tripwire's limitations. He didn't have the source for Tripwire, so he redid it from scratch. Lehti runs a CVS server over the Internet to take full advantage of the worldwide pool of programmers available to develop applications. In this article, we will look at AIDE installation and configuration, comparing it to Tripwire as necessary. If you decide to use AIDE, then you must read the man pages (man aide and man aide.conf) for the program. This article complements the documentation there.
Listing 3 Report from aide --config=./aide.conf --check
Dead symlink detected at /usr/lib/kde3/libkcm_ktalkd.so
Dead symlink detected at /lib/modules/2.4.18-3/build
Not implemented in db_readline_file 310
"@@end_db"AIDE found differences between database and filesystem!!
Config version used: v1
Start timestamp: 2002-09-29 17:51:27
Summary:
Total number of files=122266,added files=9,removed files=0,changed files=21
Added files:
added:/var/log/xferlog.2
added:/var/log/wtmp.1
Changed files:
changed:/var/log/messages
changed:/var/log/secure
changed:/var/log/xferlog.1
changed:/var/log/rpmpkgs.1
Detailed information about changes:
File: /var/log/messages
Inode : 12083, 12091
File: /var/log/secure
Inode : 12084, 12092
File: /var/log/xferlog.1
Inode : 12059, 12081
File: /var/log/rpmpkgs.1
Inode : 12079, 12082
Directory: /etc
Mtime : 2002-09-27 23:13:01, 2002-09-29 17:46:33
Directory: /etc/mrtg
Mtime : 2002-09-29 17:10:07, 2002-09-29 18:00:05
File: /etc/mrtg/mrtg.ok
Mtime : 2002-09-29 17:10:07, 2002-09-29 18:00:05
