【Debian】配置aide入侵檢測服務

//安裝aide

root@storagesrv:/#apt install aide      

//aide的配置檔案在/etc/aide下，aide.conf檔案中配置了檢測的資訊，而aide.conf.d下面有預設的系統檢測規則

root@storagesrv:/etc/aide# ls -l
total 16
-rw-r--r-- 1 root root 6601 May 11 21:59 aide.conf
drwxr-xr-x 2 root root 4096 May 11 22:29 aide.conf.d
drwxr-xr-x 2 root root 4096 May 11 07:31 aide.settings.d      

//可以在aide.conf.d下面建立一個規則檔案，前面的編号決定了優先級，若是屬性在配置檔案中沒有定義，初始化資料庫會失敗

root@storagesrv:/etc/aide/aide.conf.d# cat 10_aide_test
/mut/crypt      StaticFile      

//初始化資料庫，每次修改了配置和規則都需要重新初始化資料庫

root@storagesrv:/etc/aide/aide.conf.d# aideinit -y -f
Running aide --init...
Start timestamp: 2021-05-11 22:29:38 -0400 (AIDE 0.16.1)
AIDE initialized database at /var/lib/aide/aide.db.new
Verbose level: 6
 
Number of entries:      147985
 
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
 
/var/lib/aide/aide.db.new
  RMD160  : KZ9hFLrL0mc+cW0oHzy0ro88RgM=
  TIGER   : 8aqwbHfBUD4uG+cgSdnbTjr0OmOwcfHj
  SHA256  : 29W1GDCbbzuw78I4pZjhYe8iD9V44HKc
             JgkYhtO5PlE=
  SHA512  : xUO66cqT3rrydGY5/YLQQ0uhW8cxEeka
             3t0yXHrQmowzhIiiGVUTLvmaraza5/ja
             ZCNadU9drsb8PfRHRdjVfg==
  CRC32   : z7Flew==
  HAVAL   : GNZaJWOZTjQhMj78j7PQShUqZIDZsgXa
             vZopd0lsAQY=
  GOST    : x0dRsg5PodXwKqzhFluAaeBimddIv5Ct
             hJO9I/YoNCM=
 
End timestamp: 2021-05-11 22:38:29 -0400 (run time: 8m 51s)      

//在/var/lib/aide中有aide初始化後生成的檔案，aide.conf.autogenerated更新後生成的配置檔案，裡面有新添加的規則

root@storagesrv:/var/lib/aide# cat aide.conf.autogenerated | grep crypt
/@@{ROOTPREFIX}mut/crypt      StaticFile      

//初始化的資料庫為aide.db.new，拷貝為aide.db

root@storagesrv:/var/lib/aide# cp aide.db.new aide.db      

//将配置複制回/etc/aide下

root@storagesrv:/etc/aide# cp /var/lib/aide/aide.conf.autogenerated aide.conf      

//在檢測目錄下建立檔案

root@storagesrv:/var/lib/aide# cd /mut/crypt/
root@storagesrv:/mut/crypt# touch test{1..5}
root@storagesrv:/mut/crypt# ls -l
-rw-r--r-- 1 root root 0 May 11 23:29 test1
-rw-r--r-- 1 root root 0 May 11 23:29 test2
-rw-r--r-- 1 root root 0 May 11 23:29 test3
-rw-r--r-- 1 root root 0 May 11 23:29 test4
-rw-r--r-- 1 root root 0 May 11 23:29 test5      

//執行一次性掃描

root@storagesrv:/mut/crypt# aide.wrapper
Start timestamp: 2021-05-11 23:29:50 -0400 (AIDE 0.16.1)
AIDE found differences between database and filesystem!!
Verbose level: 6
 
Summary:
  Total number of entries:    147991
  Added entries:              6
  Removed entries:            0
  Changed entries:            6
 
---------------------------------------------------
Added entries:
---------------------------------------------------
 
f++++++++++++++++: /etc/aide/aide.conf.bak
f++++++++++++++++: /mut/crypt/test1
f++++++++++++++++: /mut/crypt/test2
f++++++++++++++++: /mut/crypt/test3
f++++++++++++++++: /mut/crypt/test4
f++++++++++++++++: /mut/crypt/test5
 
---------------------------------------------------
Changed entries:
---------------------------------------------------
 
d =.... mc.. .. .: /etc/aide
f >b... mc..C.. .: /etc/aide/aide.conf
d       mc      : /mut/crypt
d =.... mc.. .. .: /root
f <b... mci.C.. .: /root/.viminfo
f =.... mc..... .: /var/lib/systemd/timers/stamp-anacron.timer
 
---------------------------------------------------
Detailed information about changes:
---------------------------------------------------
 
Directory: /etc/aide
  Mtime   : 2021-05-11 22:44:06 -0400       | 2021-05-11 22:56:51 -0400
  Ctime   : 2021-05-11 22:44:06 -0400       | 2021-05-11 22:56:51 -0400
 
File: /etc/aide/aide.conf
  Size    : 6601                            | 42964
  Bcount  : 16                              | 88
  Mtime   : 2021-05-11 21:59:05 -0400       | 2021-05-11 22:57:09 -0400
  Ctime   : 2021-05-11 21:59:05 -0400       | 2021-05-11 22:57:09 -0400
  RMD160  : qg6gTepXW1gAJf3jNEaGSAp40pA=    | TcvzR4pijuFu6MoeFmAAz9gxQ9M=
  TIGER   : bo3B7Uq4pbJTaLwZoO4VrrNiRXZ9qv+w | ckiWoT3V4YZPcZGpTKDyaorhdQxwjWPn
  SHA256  : eutwzJ6JMx6rY3HOSYOd0AMVfIIMhVA/ | HIVzlNqm+UHE9nIm+xta4shAoQlQT7x1
             JL64qomJoJc=                     | H0L67RGCsfg=
  SHA512  : a/hC/sXXG8lpSIwX7LqzYSMKeSJm3SPA | sDALST+o0uJ7RKyrcOuBdGkXpm0eoqDA
             aqiecNU+TXqGtzvWCwKT7vRzf0OWnyW/ | XgvQxnAgyPUj+cBIJO82gWo2l41IUjQq
             jyE+lJwlsFpB6K9L7Gk8lQ==         | y2OfPpDhK1vm5hUO04xXNw==
  CRC32   : tbIxEQ==                        | fgq/eA==
  HAVAL   : 8Sb71hV6Ol97jYle+cD9W8R7kNlHyPeX | Rxe5CUJ6TD0X6P2TWiD9tkKVQ7KiUE2Y
             rGZzKLahUlY=                     | RsEcsNeue1o=
  GOST    : oqnFZQROwa5ruRGCvSH3NNOMesXpBSm9 | jmaJ1EJKRjRWVSyMl30MznLoC4hS/a3x
             EENDKvIBoJs=                     | OKMOp/ajOOg=
 
Directory: /mut/crypt
  Mtime   : 2021-05-11 22:42:29 -0400       | 2021-05-11 23:29:04 -0400
  Ctime   : 2021-05-11 22:42:29 -0400       | 2021-05-11 23:29:04 -0400
 
Directory: /root
  Mtime   : 2021-05-11 22:44:47 -0400       | 2021-05-11 22:54:34 -0400
  Ctime   : 2021-05-11 22:44:47 -0400       | 2021-05-11 22:54:34 -0400
 
File: /root/.viminfo
  Size    : 12480                           | 12141
  Bcount  : 32                              | 24
  Mtime   : 2021-05-11 22:44:47 -0400       | 2021-05-11 22:54:34 -0400
  Ctime   : 2021-05-11 22:44:47 -0400       | 2021-05-11 22:54:34 -0400
  Inode   : 529960                          | 529959
  RMD160  : ZfhzKEuYUNbc4QhcAjpwzsal+GE=    | K7Jj3i9F6jIH80zCV1LNvc9WVdo=
  TIGER   : 4TXFRKUe+gl4D/Wa1mDq2MDUeCgx990C | UGvU2l2vwRjHK8T6w9S85kGB6tEiVT4W
  SHA256  : fdgDFBjXRR+YE6CDRRGZ1TqI9oXgEFQf | bEtvk+3ek7lch8B/6zkAdpvmhokDnzOo
             nGkymGJxs9A=                     | v6l3Hu5IJhI=
  SHA512  : BxlsYnEPaq3hJVoEHxDmICKn0twptltA | qgmRrjh7jj5+kzpUctxbOpON/GuqctY1
             Xs/MojJ4NFeQuwSdvCuY43bkDnQkobAW | W39ZU+1wBJEoO47MIWz+hhlLmmXVjvFw
             lcEAFFFX8ryHMzPO2TZIig==         | CowAI6vqGh9ob5ahqjS6cg==
  CRC32   : BbQyDQ==                        | sNq00g==
  HAVAL   : A0oMbik/8XE7YtScj6IqYIQlq5wwQxMv | 6uTf16rM1661GTbLdAGFIC4qzb4KbQsb
             TYz6Sh5WwBo=                     | /TrwgyAbCG8=
  GOST    : f6SpuAIHKqtwpJpZmFpJ7LBqDAKdxEqR | Vmm8zia19s7fsWaBUP96xESgQKDkmKkH
             O8VGlgdOrBc=                     | P0lSF50TswU=
 
File: /var/lib/systemd/timers/stamp-anacron.timer
  Mtime   : 2021-05-11 22:34:55 -0400       | 2021-05-11 23:31:27 -0400
  Ctime   : 2021-05-11 22:34:55 -0400       | 2021-05-11 23:31:27 -0400
 
 
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
 
/var/lib/aide/aide.db
  RMD160  : XLnxa8vT6YLymOP5fHGqcv68L1s=
  TIGER   : LolS9xoFuRPDzzMj554mUJmUfCxkK6YF
  SHA256  : RntkidsvUEeXp4ZLog2M/1luqeQ3GN81
             lFS4aBs3xIw=
  SHA512  : xAxb9yFaGKNiAooUr6A9tmiNAANzNCpa
             QrtdTRPuEEpA3eqxX9H/PC8JgEWzih2h
             Kpn9FA2/pmv9B+XCz/CnEA==
  CRC32   : LF1YNw==
  HAVAL   : 6c24iUP3sbn40RsY/yGK9ljv/DZQsASm
             Y+sTgZp82ho=
  GOST    : lEat2jtjjcQWlBZ2oXEzCSgd+HwNWkaA
             xbqLm4TKl90=
 
 
End timestamp: 2021-05-11 23:38:46 -0400 (run time: 8m 56s)      

//其他：

//其他的基本配置可以在default下面配置，同時建立了一個計劃任務cron

root@storagesrv:~# vim /etc/default/aide
root@storagesrv:~# vim /etc/cron.daily/aide