運用(定期チェック)
改ざんチェックおよびデータベースファイルの更新（aide --update）を行います。
改ざんを検知した場合は、管理者へメール通知を行います。
管理者は、内容を確認し、問題がなければ、データベースファイルを更新します。
(mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz)
定期チェック用スクリプト
RHELでは、定期チェックのスクリプトが提供されないため、自作する必要があります。
Debian系で提供されている定期チェックスクリプトを、RHEL用に修正します。
パラメタファイル(/etc/default/aide)
後述の定期チェックスクリプトのパラメタファイルです。
結果の通知先(MAILTO)を実際にメールを送付したい宛先に設定してください。
# These settings are mainly for the wrapper scripts around aide, # such as aideinit and /etc/cron.daily/aide # This is the email address reports get mailed to MAILTO=root # Set this to suppress mailings when there's nothing to report #QUIETREPORTS=1 # This parameter defines which aide command to run from the cron script. # Sensible values are "update" and "check". # Default is "check", ensuring backwards compatibility. # Since "update" does not take any longer, it is recommended to use "update", # so that a new database is created every day. The new database needs to be # manually copied over the current one, though. COMMAND=update # This parameter defines how many lines to return per e-mail. Output longer # than this value will be truncated in the e-mail sent out. LINES=1000 # This parameter gives a grep regular expression. If given, all output lines # that _don't_ match the regexp are listed first in the script's output. This # allows to easily remove noise from the aide report. NOISE="" # This parameter defines which options are given to aide in the daily # cron job. The default is "-V4". AIDEARGS=""
定期チェックスクリプト(/etc/cron.daily/aide)
クーロンで、 aide --update を定期実行、結果をメールで通知します。
#!/bin/bash PATH="/sbin:/usr/sbin:/bin:/usr/bin" LOGDIR="/var/log/aide" LOGFILE="aide.log" CONFFILE="/etc/aide.conf" ERRORLOG="error.log" ERRORTMP=`mktemp -t "$ERRORLOG".XXXXXXXXXX` [ -f /usr/sbin/aide ] || exit 0 AIDEARGS="-V4" if [ -f /etc/default/aide ]; then . /etc/default/aide fi FQDN=`hostname -f` DATE=`date +"at %Y-%m-%d %H:%M"` # default values MAILTO="${MAILTO:-root}" DATABASE="${DATABASE:-/var/lib/aide/aide.db.gz}" LINES="${LINES:-1000}" COMMAND="${COMMAND:-check}" if [ ! -f $DATABASE ]; then ( echo "Fatal error: The AIDE database does not exist!" echo "This may mean you haven't created it, or it may mean that someone has removed it." ) | /usr/bin/mail -s "Daily AIDE report for $FQDN" $MAILTO exit 0 fi aide $AIDEARGS --$COMMAND >"$LOGDIR/$LOGFILE" 2>"$ERRORTMP" RETVAL=$? if [ -n "$QUIETREPORTS" ] && [ $QUIETREPORTS -a \! -s $LOGDIR/$LOGFILE -a \! -s $ERRORTMP ]; then # Bail now because there was no output and QUIETREPORTS is set exit 0 fi (cat << EOF; This is an automated report generated by the Advanced Intrusion Detection Environment on $FQDN ${DATE}. EOF # include error log in daily report e-mail if [ "$RETVAL" != "0" ]; then cat > "$LOGDIR/$ERRORLOG" << EOF; ***************************************************************************** * aide returned a non-zero exit value * ***************************************************************************** EOF echo "exit value is: $RETVAL" >> "$LOGDIR/$ERRORLOG" else touch "$LOGDIR/$ERRORLOG" fi < "$ERRORTMP" cat >> "$LOGDIR/$ERRORLOG" rm -f "$ERRORTMP" if [ -s "$LOGDIR/$ERRORLOG" ]; then errorlines=`wc -l "$LOGDIR/$ERRORLOG" | awk '{ print $1 }'` if [ ${errorlines:=0} -gt $LINES ]; then cat << EOF; **************************************************************************** * aide has returned many errors. * * the error log output has been truncated in this mail * **************************************************************************** EOF echo "Error output is $errorlines lines, truncated to $LINES." head -$LINES "$LOGDIR/$ERRORLOG" echo "The full output can be found in $LOGDIR/$ERRORLOG." else echo "Errors produced ($errorlines lines):" cat "$LOGDIR/$ERRORLOG" fi else echo "AIDE produced no errors." fi # include de-noised log if [ -n "$NOISE" ]; then NOISTEMP=`mktemp -t aidenoise.XXXXXXXXXX` NOISTEMP2=`mktemp -t aidenoise.XXXXXXXXXX` sed -n '1,/^Detailed information about changes:/p' "$LOGDIR/$LOGFILE" | \ grep '^\(changed\|removed\|added\):' | \ grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" > $NOISETMP2 if [ -n "$NOISE" ]; then < $NOISETMP2 grep -v "^\(changed\|removed\|added\):$NOISE" > $NOISETMP rm -f $NOISETMP2 echo "De-Noised output removes everything matching $NOISE." else mv $NOISETMP2 $NOISETMP echo "No noise expression was given." fi if [ -s "$NOISETMP" ]; then loglines=`< $NOISETMP wc -l | awk '{ print $1 }'` if [ ${loglines:=0} -gt $LINES ]; then cat << EOF; **************************************************************************** * aide has returned long output which has been truncated in this mail * **************************************************************************** EOF echo "De-Noised output is $loglines lines, truncated to $LINES." < $NOISETMP head -$LINES echo "The full output can be found in $LOGDIR/$LOGFILE." else echo "De-Noised output of the daily AIDE run ($loglines lines):" cat $NOISETMP fi else echo "AIDE detected no changes after removing noise." fi rm -f $NOISETMP echo "============================================================================" fi # include non-de-noised log if [ -s "$LOGDIR/$LOGFILE" ]; then loglines=`wc -l "$LOGDIR/$LOGFILE" | awk '{ print $1 }'` if [ ${loglines:=0} -gt $LINES ]; then cat << EOF; **************************************************************************** * aide has returned long output which has been truncated in this mail * **************************************************************************** EOF echo "Output is $loglines lines, truncated to $LINES." head -$LINES "$LOGDIR/$LOGFILE" echo "The full output can be found in $LOGDIR/$LOGFILE." else echo "Output of the daily AIDE run ($loglines lines):" cat "$LOGDIR/$LOGFILE" fi else echo "AIDE detected no changes." fi ) | /bin/mail -s "Daily AIDE report for $FQDN" $MAILTO
