Fedora Linux

the package sysklogd.

8.7.4. Where Can I Learn More?

? The manpages for syslogd , syslog.conf , klogd , logrotate , and logwatch

? The home page for logwatch : http://www.logwatch.org

8.8. Detecting File Changes with AIDE

The Advanced Intrusion Detection Environment (AIDE) is a program that takes a 'fingerprint' of system files so that changes in those files can be detected. You can use it to detect a system intrusion, accidental file overwrites, and file corruption.

8.8.1. How Do I Do That?

To initialize the AIDE fingerprint database, execute it with the --init option:

# aide --init
AIDE, version 0.11
### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

It will take several minutes to run. When it is finished, a fingerprint database will be saved as /var/lib/aide/aide.db.new.gz . Rename it to /var/lib/aide/aide.db.gz to make it the active AIDE database:

# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Once the fingerprint database is configured, you can check for file changes using the --check argument:

# aide --check
AIDE found differences between database and filesystem!!
Start timestamp: 2006-06-01 12:50:01
Summary:
 Total number of files: 127172
 Added files: 2
 Removed files: 0
 Changed files: 4
---------------------------------------------------
Added files:
---------------------------------------------------
added:/root/.xauth0VekVw
added:/root/.xauthcvqPrt
---------------------------------------------------
Changed files:
---------------------------------------------------
changed:/root
changed:/root/.lesshst
changed:/bin
changed:/bin/date
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
Directory: /root
Mtime : 2006-06-01 09:51:05 , 2006-06-01 11:43:23
Ctime : 2006-06-01 09:51:05 , 2006-06-01 11:43:23
File: /root/.lesshst
Mtime : 2006-06-01 10:57:21 , 2006-06-01 12:47:34
Ctime : 2006-06-01 10:57:21 , 2006-06-01 12:47:34
Directory: /bin
Mtime : 2006-03-21 00:18:37 , 2006-06-01 12:49:18
Ctime : 2006-03-21 00:18:37 , 2006-06-01 12:49:18
File: /bin/date
Size : 54684 , 2003
Bcount : 128 , 16
Permissions: -rwxr-xr-x , -rws--x--x
Mtime : 2006-02-11 01:43:13 , 2006-06-01 12:49:18
Ctime : 2006-03-21 00:11:18 , 2006-06-01 12:49:32
Inode : 1986165 , 1977386
MD5 : sGkOBZz1ixmfifDWyS5PNw== , RUhh+HqFShK4bABDxePEtw==
SHA1 : mY4z3oD64L+e36a7s2LQ32E4k+8= , NAkwd0kI05k8svWFerYN5k8C1t0=

A copy of this report is automatically saved in /var/log/aide.log.

In this case, AIDE has detected a change in /bin/date and in /root/.lesshst (the history for the less command). The change to date is of particular note because that is a commonly used program, and the new version is configured with the set-user-ID bit set, meaning that any user typing date will