Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Guided Exercise: Detecting File System Changes with AIDE

In this exercise, you will install AIDE, perform an initial baseline scan, and then make changes to files on a monitored file system in order to explore how AIDE detects and reports those changes.

Outcomes

You should be able to:

  • Install the aide package.

  • Modify the /etc/aide.conf configuration file.

  • Perform an initial baseline scan.

  • Detect changes made to files since the baseline scan with a subsequent scan.

  • Update the AIDE database to accept approved changes to the file system.

Verify that the workstation and servera machines are started.

Log in to workstation as student using student as the password. On workstation, run the lab aide-detect setup command to prepare the classroom environment for the guided exercise. This command verifies that neither AIDE nor its configuration and database directory have been installed on servera. Additionally, this command verifies that the Cron job scheduler is installed on servera. 

[student@workstation ~]$ lab aide-detect setup

  1. From workstation, log in to servera as the student user. Public-key authentication has been set up for the student user between these two machines so that you can log in without a password. 

    [student@workstation ~]$ ssh student@servera
Last login: Wed Jul 18 04:56:35 2018 from workstation.lab.example.com
[student@servera ~]$

    The following commands are executed on servera.

  2. Change to the root user and install the aide package.

    1. Use sudo -i to log in as root interactively from the student account. Use student as the password. 

      [student@servera ~]$ sudo -i
[sudo] password for student: student
[root@servera ~]#

    2. Install the aide package.

      [root@servera ~]# yum install aide
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package aide.x86_64 0:0.15.1-13.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=====================================================================
 Package                   Arch                        Version                              Repository                             Size
=====================================================================
Installing:
 aide                      x86_64                      0.15.1-13.el7                        rhel--server-dvd                      133 k

Transaction Summary
=====================================================================
Install  1 Package

Total download size: 133 k
Installed size: 311 k
Is this ok [y/d/N]: y
...output omitted...
Installed:
  aide.x86_64 0:0.15.1-13.el7

Complete!

  3. Back up the original copy of the AIDE configuration file.

    [root@servera ~]# cp /etc/aide.conf /etc/aide.conf.orig

  4. Modify the AIDE configuration file (/etc/aide.conf) so that AIDE monitors the directories /etc (existing directory) and /testdir (new directory) for any change in permissions and file content. Use regular selection lines so that the contents of those directories are also monitored. Remove all other selection lines not associated with the mentioned directories.

    Note

    We have asked you to remove the other selection lines in order to speed up preparation of the AIDE database for this exercise. This will cause AIDE to only analyze a handful of the files on the system. In practice you might decide to keep or adjust the default selection lines, rather than removing them. 

    [root@servera ~]# vim /etc/aide.conf

    The last few lines of the modified /etc/aide.conf file should look like the following example. 

    ...output omitted...
# Extended content + file type + access.
CONTENT_EX = sha256+ftype+p+u+g+n+acl+selinux+xattrs

# Some files get updated automatically, so the inode/ctime/mtime change
# but we want to know when the data inside them changes.
DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+sha256

# Next decide what directories/files you want in the database. Aide
# uses a first match system. Put file specific instructions before generic
# matches. e.g. Put file matches before directories.

/etc           CONTENT_EX
/testdir       CONTENT_EX

    The CONTENT_EX group definition is provided in the default /etc/aide.conf file. Any selection line that uses it will monitor the selected files for any change in content, Linux file type, number of links, ownership, permissions, SELinux context, and extended attributes.

    The two selection lines cause AIDE to monitor any object within the hierarchy of the /etc and /testdir directories in the file system using the checks specified by the CONTENT_EX group definition.

  5. Create the /testdir directory.

    [root@servera ~]# mkdir /testdir

  6. Initialize the database with the aide --init command. This performs an initial baseline scan, generating a new AIDE database that records the current state of the file system hierarchy. 

    [root@servera ~]# aide --init

AIDE, version 0.15.1

### AIDE database at /var/lib/aide/aide.db.new.gz initialized.

  7. Rename the new AIDE database file, /var/lib/aide/aide.db.new.gz, to /var/lib/aide/aide.db.gz so that AIDE will use the newly generated file as the current database. (The file name of any new database generated, and that of the database actually used by AIDE, are set in /etc/aide.conf by default.) 

    [root@servera ~]# mv /var/lib/aide/aide.db.new.gz \
> /var/lib/aide/aide.db.gz

  8. Determine the current status of the machine's file systems.

    [root@servera ~]# aide --check

AIDE, version 0.15.1

### All files match AIDE database. Looks okay!

    AIDE reports that there have been no changes to the files and directories it monitors. This makes sense, because you have not changed any files or directories since initializing the AIDE database.

  9. Create a new file called /testdir/testfile. This file is in one of the directories that you configured AIDE to monitor. 

    [root@servera ~]# touch /testdir/testfile

  10. Again determine the current status of the machine's file systems.

    [root@servera ~]# aide --check
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2018-07-18 12:37:55

Summary:
  Total number of files:  2606
  Added files:            1
  Removed files:          0
  Changed files:          0


---------------------------------------------------
Added files:
---------------------------------------------------

added: /testdir/testfile

    AIDE reports that the file /testdir/testfile has been added. It also reports that it scanned a total of 2606 files. No files have been removed or changed.

  11. Modify the permissions of the /etc/shadow file to 644 (read/write for user, read-only for group and other).

    [root@servera ~]# chmod 644 /etc/shadow

  12. Determine the current status of the machine's file systems.

    [root@servera ~]# aide --check
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2018-07-18 12:50:20

Summary:
  Total number of files:  2606
  Added files:            1
  Removed files:          0
  Changed files:          1


---------------------------------------------------
Added files:
---------------------------------------------------

added: /testdir/testfile

---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/shadow

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /etc/shadow
 Perm     : ----------                       , -rw-r--r--
 ACL      : old = A:
----
user::---
group::---
other::---
----
                  D: <NONE>
            new = A:
----
user::rw-
group::r--
other::r--
----
                  D: <NONE>

    AIDE reports that the permissions of /etc/shadow have changed and what those changes are. It also still reports about the newly created file, /testdir/testfile.

  13. Restore the file permissions of /etc/shadow to 000 (no access for user, group, or other). 

    [root@servera ~]# chmod 000 /etc/shadow

  14. Determine the current status of the file system.

    [root@servera ~]# aide --check
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2018-07-18 13:07:26

Summary:
  Total number of files:  2606
  Added files:            1
  Removed files:          0
  Changed files:          0


---------------------------------------------------
Added files:
---------------------------------------------------

added: /testdir/testfile

    After restoring the file permissions of the /etc/shadow file, AIDE no longer reports that it has changed. It does still report about the newly created file /testdir/testfile, because that change has not been reverted.

    Note

    If the CONTENT_EX group definition included the c group to monitor ctime (status change time stamp) updates, the /etc/shadow file would still report a change, because ctime is updated when permissions are changed.

    That time stamp is separate from the mtime (modification time stamp) that AIDE monitors with the m group and which shows up in normal ls -l listings to indicate when the contents of the file last changed.

  15. Implement a cron job to automatically run AIDE to check the current status of the file systems. It should run as the root user at 12 noon on a weekly basis. Create an /etc/cron.d/aide file containing the appropriate job specification. 

    [root@servera ~]# vim /etc/cron.d/aide

    The /etc/cron.d/aide file should contain the following content.

    00 12 */7 * * root /sbin/aide --check

    Using this automated approach of verifying the file system's current status allows administrators to periodically monitor the file system for changes and merge the accepted changes with the AIDE database.

    Note

    This is not the only way to implement a system cron job to automatically run AIDE. For example, it could also be defined in /etc/crontab. The advantage of using a separate /etc/cron.d/aide file is that it is easier and less error prone to deploy the cron configuration by creating a new file on the system than by editing an existing file.

  16. Generate an updated AIDE database to accept the changes you made to the machine's file systems. Rename the newly generated aide.db.new.gz file to aide.db.gz to ensure that AIDE uses the correct database to detect file system changes. 

    [root@servera ~]# aide --update
...output omitted...
[root@servera ~]# mv /var/lib/aide/aide.db.new.gz \
> /var/lib/aide/aide.db.gz

  17. Confirm that you successfully updated the AIDE database to reflect the changes to the machine's file systems.

    [root@servera ~]# aide --check

AIDE, version 0.15.1

### All files match AIDE database. Looks okay!

    If you succeeded, AIDE will no longer report that /testdir/testfile is a new file.

  18. Log out from the servera system completely.

    [root@servera ~]# logout
[student@servera ~]$ logout
[student@workstation ~]$

Cleanup

On workstation, run the lab aide-detect cleanup command to clean up this exercise.

This command uninstalls AIDE, deletes the configuration and database remnants of AIDE, deletes any file system objects created in this guided exercise. This command also deletes the cron job to run the file system check on a weekly basis, created in this guided exercise. Running this command causes you to lose all of your work done as a part of this guided exercise. 

[student@workstation ~]$ lab aide-detect cleanup

This concludes the guided exercise.

PreviousNext
Revision: rh415-7.5-813735c