{{tag>Brouillon Sécurité}}

= Contrôle d'intégrité des fichiers avec AIDE

Voir aussi 
* [[verifier_integrite_des_fichiers]]
* [[Vérifier l'intégrité des fichiers avec Fim]]
* [[https://en.wikipedia.org/wiki/OSSEC|OSSEC]]
* [[http://devloop.users.sourceforge.net/index.php?article68/initiation-au-systeme-de-detection-d-intrusion-samhain|Samhain]]
* Tripwire


Voir :
* https://kifarunix.com/install-and-configure-aide-on-debian-10/
* https://www.server-world.info/en/note?os=Ubuntu_18.04&p=aide
* https://www.it-connect.fr/aide-utilisation-et-configuration-dune-solution-de-controle-dintegrite-sous-linux/
* https://linuxhint.com/debian_linux_advanced_instrusion_detection_env/
* https://www.howtoforge.com/how-to-install-and-use-aide-on-centos-8/

== Install

<code bash>
apt-get install aide aide-common
</code>


== Utilisation

Initialisation
<code bash>
aideinit
</code>

Contrôle
<code bash>
aide.wrapper --check

aide.wrapper --check --limit /etc
</code>

Mise à jour de la base
<code bash>
aide.wrapper -u
</code>

== Configuration

<code - /etc/aide/aide.conf.d/31_aide_plop>
#/var/log$ VarDir

# Exlusion list
!/var/lib/docker/
!/var/log/journal/
!/var/log/commands.log
!/run/
!/mnt/
!/etc/.git/
!/etc/.etckeeper
!/var/tmp/
!/var/log/
!/root/.viminfo
!/root/.bash_history
!/root/.lesshst
!/var/lib/sss/mc/passwd
!/usr/NX/var/tmp/
!/var/lib/sss/db/
</code>

Check conf
<code bash>
aide.wrapper --config-check
</code>

== Pb

=== Segmentation fault (core dumped)

<code ->
# aideinit
Overwrite existing /var/lib/aide/aide.db.new [Yn]? Y
Running aide --init...
Segmentation fault (core dumped)
AIDE --init return code 139
</code>

<code ->
# dmesg |tail
[169712.662630] aide[428807]: segfault at 0 ip 00007f9fd5e7b14b sp 00007ffc48052578 error 4 in libc-2.31.so[7f9fd5d80000+178000]
[169712.662645] Code: 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 8b 05 25 ad 0c 00 48 83 ff 10 74 47 48 83 ff 1a 74 49 48 8b 40 60 <48> 8b 10 48 85 d2 75 12 eb 1b 0f 1f 00
48 8b 50 10 48 83 c0 10 48
</code>

==== Solution : Exclure les dossiers problématiques

Trouver la où se plante avec ''lsof'' ou ''strace''
<code bash>
aideinit &

while PID_AIDE=$(pgrep aide ||exit 2) ; do lsof -p $(pgrep -n aide) |tee -a aide_lsof.log ; done

watch -d lsof -p $(pgrep -n aide)
</code>

Créer une liste d'exclusions
<code - /etc/aide/aide.conf.d/31_aide_plop>
!/var/lib/docker/
!/var/log/journal/
</code>

puis relancer
<code bash>
aideinit
</code>

=== Erreur Database does not have attr field.

<code bash>
aide --check -c /etc/aide/aide.conf
</code>

<code ->
Database does not have attr field.
Comparation may be incorrect
Generating attr-field from dbspec
It might be a good Idea to regenerate databases. Sorry.
db_char2line():Error while reading database
</code>

La base n'est pas complete. Vérifier la taille de /var/lib/aide/aide.db.new.

==== Solution

Si paquet **aide-common** installé

<code bash>
aideinit
</code>

Sinon
<code bash>
aide --init -c /etc/aide/aide.conf
cp -p /var/lib/aide/aide.db.new /var/lib/aide/aide.db
</code>

== Notes

Debug

<code bash>
aide -D
aide -V255 --config=/etc/aide/aide.conf -C
</code>

== Conf

<code - /etc/aide/aide.conf.d/31_aide_plop>
#/var/log$ VarDir
!/var/lib/docker/
!/var/log/journal/
!/var/log/commands.log
!/run/
!/etc/.git/
!/etc/.etckeeper
!/var/tmp/
!/var/log/
!/root/.viminfo
!/root/.bash_history
!/root/.lesshst
</code>



Source : https://raw.githubusercontent.com/duritong/puppet-aide/master/files/aide.conf

<code - /etc/aide.conf>
# AIDE conf

database=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new

# Change this to "no" or remove it to not gzip output
# (only useful on systems with few CPU cycles to spare)
gzip_dbout=yes

# Here are all the things we can check - these are the default rules 
#
#p:      permissions
#i:      inode
#n:      number of links
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#md5:    md5 checksum
#sha1:   sha1 checksum
#rmd160: rmd160 checksum
#tiger:  tiger checksum
#R:      p+i+n+u+g+s+m+c+md5
#L:      p+i+n+u+g
#E:      Empty group
#>:      Growing logfile p+u+g+i+n+S
#haval:         haval checksum
#gost:          gost checksum
#crc32:         crc32 checksum

# Defines formerly set here have been moved to /etc/default/aide.

# Custom rules
Binlib = p+i+n+u+g+s+b+m+c+md5+sha1
ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha1
Logs = p+i+n+u+g+S
Devices = p+i+n+u+g+s+b+c+md5+sha1
Databases = p+n+u+g
StaticDir = p+i+n+u+g
ManPages = p+i+n+u+g+s+b+m+c+md5+sha1

# Next decide what directories/files you want in the database

# Kernel, system map, etc.
=/boot$ Binlib
# Binaries
/bin Binlib
/sbin Binlib
/usr/bin Binlib
/usr/sbin Binlib
/usr/local/bin Binlib
/usr/local/sbin Binlib
#/usr/games Binlib
# Libraries
/lib Binlib
/usr/lib Binlib
/usr/local/lib Binlib
# Log files
#=/var/log$ StaticDir
#!/var/log/ksymoops
#/var/log/aide/aide.log(.[0-9])?(.gz)? Databases
#/var/log/aide/error.log(.[0-9])?(.gz)? Databases
#/var/log/setuid.changes(.[0-9])?(.gz)? Databases
#!/var/log/aide
#/var/log Logs
# Devices
!/dev/pts
# If you get spurious warnings about being unable to mmap() /dev/cpu/mtrr,
# you may uncomment this to get rid of them. They're harmless but sometimes
# annoying.
#!/dev/cpu/mtrr
#!/dev/xconsole
/dev Devices
# Other miscellaneous files
/var/run$ StaticDir
!/var/run
# Test only the directory when dealing with /proc
/proc$ StaticDir
!/proc

# You can look through these examples to get further ideas

# MD5 sum files - especially useful with debsums -g
#/var/lib/dpkg/info/([^\.]+).md5sums u+g+s+m+md5+sha1

# Check crontabs
#/var/spool/anacron/cron.daily Databases
#/var/spool/anacron/cron.monthly Databases
#/var/spool/anacron/cron.weekly Databases
#/var/spool/cron Databases
#/var/spool/cron/crontabs Databases

# manpages can be trojaned, especially depending on *roff implementation
#/usr/man ManPages
/usr/share/man ManPages
/usr/local/man ManPages

# docs
#/usr/doc ManPages
/usr/share/doc ManPages

# check users' home directories
#/home Binlib

# check sources for modifications
#/usr/src L
#/usr/local/src L

# Check headers for same
/usr/include L
#/usr/local/include L

#!/var/log/portage/elog
#!/var/log/puppet/puppet.log
!/var/log     # ignore the log dir it changes too often
!/dev/disk/by-uuid  # ignore, because its only crypt-swap, that changes every boot ...

</code>