OpenSUSE Leap 42: File integrity check with AIDE

Table of Contents

1 Before install AIDE

Install Postfix with this script.

2 Install AIDE

Install aide package.

> sudo zypper -n in aide> sudo sed -e ‘s/^verbose=.*/verbose=5/g’ -i /etc/aide.conf

3 Create database

Running “aide –init” creates And you need to copy it to aide.db.

> sudo aide –init.> sudo cp /var/lib/aide/ /var/lib/aide/aide.db

4 File integrity check

aide –check checks file integrity. aide –update checks file integrity and create new database This needs to copy to aide.db.

> sudo aide –check<snip>> echo $?0

If some file is changed, aide will return non zero value.

> sudo mv /usr/sbin/ip /usr/sbin/ip.orig> echo “modified” | sudo tee /usr/sbin/ip> sudo aide –check<snip>> echo $?4

5 Cron job which runs aide

You need to create cron job. This article will creates daily cron job which runs “aide –update” and send email.

> sudo zypper -n in mailx procmail> cat <<EOF | sudo tee /etc/cron.daily/aide#!/bin/shLOCK_FILE=/var/run/aide.lockMAIL_ADDR=root@localhostlockfile ${LOCK_FILE} || exit 1TMP=$(mktemp -t aide.XXXXXX)trap “rm $TMP* 2>/dev/null” 0aide –update > ${TMP} 2>&1ret=$?if [ ${ret} -eq 0 ]; then # Nothing is changed. cp /var/lib/aide/ /var/lib/aide/aide.dbelif [ ${ret} -lt 8 ]; then # Some file is changed. cat ${TMP} | mail -s “AIDE detects changes” ${MAIL_ADDR} cp /var/lib/aide/ /var/lib/aide/aide.dbelse # Cannot update database. cat ${TMP} | mail -s “AIDE fatal error” ${MAIL_ADDR}firm -f ${LOCK_FILE}EOF> sudo chmod a+x /etc/cron.daily/aide

Android | Linux | SDL - Narrow Escape