Chapter 8. Checking integrity with AIDE

Procedure

1. Install the aide package:

   Copy to Clipboard Toggle word wrap

   # dnf install aide

2. Generate an initial database:

   Copy to Clipboard Toggle word wrap

   # aide --init
   Start timestamp: 2024-07-08 10:39:23 -0400 (AIDE 0.16)
   AIDE initialized database at /var/lib/aide/aide.db.new.gz
   
   Number of entries:	55856
   
   ---------------------------------------------------
   The attributes of the (uncompressed) database(s):
   ---------------------------------------------------
   
   /var/lib/aide/aide.db.new.gz
   …
     SHA512   : mZaWoGzL2m6ZcyyZ/AXTIowliEXWSZqx
                IFYImY4f7id4u+Bq8WeuSE2jasZur/A4
                FPBFaBkoCFHdoE/FW/V94Q==

3. Optional: In the default configuration, the aide --init command checks just a set of directories and files defined in the /etc/aide.conf file. To include additional directories or files in the AIDE database, and to change their watched parameters, edit /etc/aide.conf accordingly.

4. To start using the database, remove the .new substring from the initial database file name:

   Copy to Clipboard Toggle word wrap

   # mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

5. Optional: To change the location of the AIDE database, edit the /etc/aide.conf file and modify the DBDIR value. For additional security, store the database, configuration, and the /usr/sbin/aide binary file in a secure location such as a read-only media.

Procedure

1. To initiate a manual check:

   Copy to Clipboard Toggle word wrap

   # aide --check
   Start timestamp: 2024-07-08 10:43:46 -0400 (AIDE 0.16)
   AIDE found differences between database and filesystem!!
   
   Summary:
     Total number of entries:	55856
     Added entries:		0
     Removed entries:		0
     Changed entries:		1
   
   ---------------------------------------------------
   Changed entries:
   ---------------------------------------------------
   
   f   ...      ..S : /root/.viminfo
   
   ---------------------------------------------------
   Detailed information about changes:
   ---------------------------------------------------
   
   File: /root/.viminfo
     SELinux  : system_u:object_r:admin_home_t:s | unconfined_u:object_r:admin_home
                0                                | _t:s0
   …

2. At a minimum, configure the system to run AIDE weekly. Optimally, run AIDE daily. For example, to schedule a daily execution of AIDE at 04:05 a.m. by using the cron command, add the following line to the /etc/crontab file:

   Copy to Clipboard Toggle word wrap

    05 4 * * * root /usr/sbin/aide --check

Procedure

1. Update your baseline AIDE database:

   Copy to Clipboard Toggle word wrap

   # aide --update

   The aide --update command creates the /var/lib/aide/aide.db.new.gz database file.

2. To start using the updated database for integrity checks, remove the .new substring from the file name.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Configure system integrity
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure file integrity checks with AIDE
         ansible.builtin.include_role:
           name: rhel-system-roles.aide.aide
         vars:
           aide_db_fetch_dir: files
           aide_init: true
           aide_check: false
           aide_update: false
           aide_cron_check: true
           aide_cron_interval: 0 12 * * *

   The settings specified in the example playbook include the following:

   aide_db_fetch_dir: files

   Specifies the directory on the Ansible Control Node (ACN) for storing the AIDE database fetched from the remote nodes. With the default files value, the role stores the database in the same directory as the playbook. To store the database files somewhere else, specify a different path.

   aide_check: false

   Runs an integrity check on the remote nodes.

   aide_update: false

   Updates the AIDE database and stores it on the control node.

   aide_cron_check: true

   Configures a periodic cron job that activates AIDE integrity checks on the managed nodes.

   aide_cron_interval: 0 12 * * *

   Sets the interval for the cron job in the format <minute> <hour> <day_of_month> <month> <day of week>. The value 0 12 * * * sets it to run every day at noon.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.aide/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml