343 lines
No EOL
8.2 KiB
Text
343 lines
No EOL
8.2 KiB
Text
# Example configuration file for AIDE.
|
|
|
|
@@define DBDIR /var/lib/aide
|
|
@@define LOGDIR /var/log/aide
|
|
|
|
# The location of the database to be read.
|
|
database_in=file:@@{DBDIR}/aide.db.gz
|
|
|
|
# The location of the database to be written.
|
|
#database_out=sql:host:port:database:login_name:passwd:table
|
|
#database_out=file:aide.db.new
|
|
database_out=file:@@{DBDIR}/aide.db.new.gz
|
|
|
|
# Whether to gzip the output to database
|
|
gzip_dbout=yes
|
|
|
|
# Database attributes to include in report (H = all compiled hashsums, default)
|
|
database_attrs=H
|
|
|
|
# Add metadata to database (version info, timestamps)
|
|
database_add_metadata=yes
|
|
|
|
# Warn about unrestricted rules during config check (default: false)
|
|
config_check_warn_unrestricted_rules=false
|
|
|
|
# Number of workers for parallel processing (default: 1, can use percentage)
|
|
num_workers=1
|
|
|
|
# Default.
|
|
log_level=warning
|
|
report_level=changed_attributes
|
|
|
|
# Report format (plain or json)
|
|
report_format=plain
|
|
|
|
# Group files in report by added/removed/changed
|
|
report_grouped=yes
|
|
|
|
# Summarize changes in report
|
|
report_summarize_changes=yes
|
|
|
|
# Don't report if no differences found
|
|
report_quiet=no
|
|
|
|
# Report encoding (base64 is default, base16 available)
|
|
report_base16=no
|
|
|
|
report_url=file:@@{LOGDIR}/aide.log
|
|
report_url=stdout
|
|
#report_url=stderr
|
|
#report_url=syslog:LOG_AUTH
|
|
|
|
# These are the default rules.
|
|
#
|
|
#ftype: file type
|
|
#fstype: file system type (Linux-only)
|
|
#p: permissions
|
|
#i: inode
|
|
#l: link name (symbolic links only)
|
|
#n: number of links
|
|
#u: user
|
|
#g: group
|
|
#s: size
|
|
#b: block count
|
|
#m: mtime
|
|
#a: atime
|
|
#c: ctime
|
|
#acl: Access Control Lists
|
|
#selinux SELinux security context
|
|
#xattrs: Extended file attributes
|
|
#e2fsattrs: file attributes on Linux file system
|
|
#caps: file capabilities (Linux-only)
|
|
|
|
# Hashsums attributes (regular files only)
|
|
#sha256: sha256 checksum
|
|
#sha512: sha512 checksum
|
|
#sha512_256: SHA-512 checksum truncated to 256 output bits
|
|
#sha3_256: SHA3-256 checksum (modern)
|
|
#sha3_512: SHA3-512 checksum (modern)
|
|
#stribog256: GOST R 34.11-2012, 256 bit
|
|
#stribog512: GOST R 34.11-2012, 512 bit
|
|
|
|
# DEPRECATED (will be removed in future versions):
|
|
#md5: md5 checksum (deprecated since v0.19)
|
|
#sha1: sha1 checksum (deprecated since v0.19)
|
|
#rmd160: rmd160 checksum (deprecated since v0.19)
|
|
#gost: gost checksum (deprecated since v0.19)
|
|
|
|
# REMOVED in AIDE v0.19:
|
|
#S: check for growing size (use 'growing+s' instead)
|
|
#tiger: tiger checksum (removed)
|
|
#haval: haval checksum (removed)
|
|
#crc32: crc32 checksum (removed)
|
|
#crc32b: crc32b checksum (removed)
|
|
#whirlpool: whirlpool checksum (removed)
|
|
|
|
# Special attributes for advanced use cases:
|
|
#I: ignore changed filename - detects moved files by inode
|
|
#growing: ignore growing file size/timestamps for logs
|
|
#compressed: ignore compression - compares uncompressed content
|
|
#ANF: allow new files - new files ignored in report
|
|
#ARF: allow removed files - missing files ignored in report
|
|
|
|
# Default groups in AIDE v0.19:
|
|
# R = p+ftype+i+l+n+u+g+s+m+c+sha3_256+X
|
|
# L = p+ftype+i+l+n+u+g+X
|
|
# > = Growing file p+ftype+l+u+g+i+n+s+growing+X
|
|
# H = all compiled in (and not deprecated) hashsums
|
|
# X = acl+selinux+xattrs+e2fsattrs+caps (if compiled in)
|
|
# E = Empty group
|
|
# Use 'aide --version' to list the default compound groups.
|
|
|
|
# You can create custom rules like this.
|
|
# Note: Removed deprecated/removed hashsums (tiger, haval, crc32, crc32b, whirlpool, md5, sha1, rmd160, gost)
|
|
# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32+crc32b (old with deprecated/removed)
|
|
ALLXTRAHASHES = sha256+sha512+sha512_256+sha3_256+sha3_512+stribog256+stribog512
|
|
# Everything but access time (Ie. all changes) - updated with modern hashsums
|
|
EVERYTHING = R+ALLXTRAHASHES
|
|
|
|
# Base + sha512 (strong)
|
|
NORMAL = R+sha512
|
|
|
|
CONTENT = ftype+sha256
|
|
|
|
# For directories, don't bother doing hashes - added file type and link name
|
|
DIR = ftype+p+i+l+n+u+g+acl+selinux+xattrs
|
|
|
|
# Access control only - added file type and link name
|
|
PERMS = ftype+p+i+l+u+g+acl+selinux
|
|
|
|
# Logfile are special, in that they often change
|
|
LOG = >
|
|
|
|
# Some files get updated automatically, so the inode/ctime/mtime change
|
|
# but we want to know when the data inside them changes - updated with modern hash
|
|
DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha_256
|
|
|
|
# Next decide what directories/files you want in the database.
|
|
|
|
/boot/ NORMAL
|
|
/bin/ NORMAL
|
|
/sbin/ NORMAL
|
|
/lib/ NORMAL
|
|
/lib64/ NORMAL
|
|
# Monitor /opt selectively to avoid noise from auto-updating applications
|
|
/opt/ CONTENT
|
|
/usr/ NORMAL
|
|
# These are too volatile
|
|
!/usr/src
|
|
!/usr/tmp
|
|
|
|
/root NORMAL
|
|
# Admins dot files constantly change, just check perms
|
|
/root/\..* PERMS
|
|
|
|
# Check only permissions, inode, user and group for /etc, but
|
|
# cover some important files closely.
|
|
/etc PERMS
|
|
!/etc/mtab
|
|
# Ignore backup files
|
|
!/etc/.*~
|
|
|
|
# trusted databases
|
|
/etc/hosts$ NORMAL
|
|
/etc/host.conf$ NORMAL
|
|
/etc/hostname$ NORMAL
|
|
/etc/issue$ NORMAL
|
|
/etc/issue.net$ NORMAL
|
|
/etc/protocols$ NORMAL
|
|
/etc/services$ NORMAL
|
|
/etc/localtime$ NORMAL
|
|
/etc/alternatives/ NORMAL
|
|
/etc/mime.types$ NORMAL
|
|
/etc/terminfo/ NORMAL
|
|
/etc/exports$ NORMAL
|
|
/etc/fstab$ NORMAL
|
|
/etc/passwd$ NORMAL
|
|
/etc/group$ NORMAL
|
|
/etc/gshadow$ NORMAL
|
|
/etc/shadow$ NORMAL
|
|
/etc/security/opasswd$ NORMAL
|
|
/etc/skel/ NORMAL
|
|
|
|
# networking
|
|
/etc/hosts.allow$ NORMAL
|
|
/etc/hosts.deny$ NORMAL
|
|
/etc/firewalld/ NORMAL
|
|
/etc/NetworkManager/ NORMAL
|
|
/etc/networks$ NORMAL
|
|
/etc/dhcp/ NORMAL
|
|
/etc/wpa_supplicant/ NORMAL
|
|
/etc/resolv.conf$ DATAONLY
|
|
/etc/nscd.conf$ NORMAL
|
|
|
|
# logins and accounts
|
|
/etc/login.defs$ NORMAL
|
|
/etc/libuser.conf$ NORMAL
|
|
/var/log/faillog$ PERMS
|
|
/var/log/lastlog$ PERMS
|
|
/var/run/faillock/ PERMS
|
|
/etc/pam.d/ NORMAL
|
|
/etc/security$ NORMAL
|
|
/etc/securetty$ NORMAL
|
|
/etc/polkit-1/ NORMAL
|
|
/etc/sudo.conf$ NORMAL
|
|
/etc/sudoers$ NORMAL
|
|
/etc/sudoers.d/ NORMAL
|
|
|
|
# Shell/X starting files
|
|
/etc/profile$ NORMAL
|
|
/etc/profile.d/ NORMAL
|
|
/etc/bashrc$ NORMAL
|
|
/etc/bash_completion.d/ NORMAL
|
|
/etc/zprofile$ NORMAL
|
|
/etc/zshrc$ NORMAL
|
|
/etc/zlogin$ NORMAL
|
|
/etc/zlogout$ NORMAL
|
|
/etc/X11/ NORMAL
|
|
/etc/shells$ NORMAL
|
|
|
|
# Pkg manager
|
|
/etc/yum.conf$ NORMAL
|
|
/etc/yum/ NORMAL
|
|
/etc/yum.repos.d/ NORMAL
|
|
|
|
/etc/audit/ NORMAL
|
|
/etc/audisp/ NORMAL
|
|
/etc/libaudit.conf$ NORMAL
|
|
/etc/aide.conf$ NORMAL
|
|
|
|
# System logs
|
|
/etc/rsyslog.conf$ NORMAL
|
|
/etc/rsyslog.d/ NORMAL
|
|
/etc/logrotate.conf$ NORMAL
|
|
/etc/logrotate.d/ NORMAL
|
|
/var/log/ LOG+ANF+ARF
|
|
/var/run/utmp$ LOG
|
|
|
|
# secrets
|
|
/etc/pkcs11/ NORMAL
|
|
/etc/pki/ NORMAL
|
|
/etc/ssl/ NORMAL
|
|
/etc/certmonger/ NORMAL
|
|
|
|
# init system
|
|
/etc/systemd/ NORMAL
|
|
/etc/sysconfig/ NORMAL
|
|
/etc/rc.d/ NORMAL
|
|
/etc/tmpfiles.d/ NORMAL
|
|
/etc/machine-id$ NORMAL
|
|
|
|
# boot config
|
|
/etc/grub.d/ NORMAL
|
|
/etc/grub2.cfg$ NORMAL
|
|
/etc/dracut.conf$ NORMAL
|
|
/etc/dracut.conf.d/ NORMAL
|
|
|
|
# glibc linker
|
|
/etc/ld.so.cache$ NORMAL
|
|
/etc/ld.so.conf$ NORMAL
|
|
/etc/ld.so.conf.d/ NORMAL
|
|
|
|
# kernel config
|
|
/etc/sysctl.conf$ NORMAL
|
|
/etc/sysctl.d/ NORMAL
|
|
/etc/modprobe.d/ NORMAL
|
|
/etc/modules-load.d/ NORMAL
|
|
/etc/depmod.d/ NORMAL
|
|
/etc/udev/ NORMAL
|
|
/etc/crypttab$ NORMAL
|
|
|
|
#### Daemons ####
|
|
|
|
# cron jobs
|
|
/var/spool/at/ CONTENT
|
|
/etc/at.allow$ CONTENT
|
|
/etc/at.deny$ CONTENT
|
|
/etc/cron.allow$ NORMAL
|
|
/etc/cron.deny$ NORMAL
|
|
/etc/cron.d/ NORMAL
|
|
/etc/cron.daily/ NORMAL
|
|
/etc/cron.hourly/ NORMAL
|
|
/etc/cron.monthly/ NORMAL
|
|
/etc/cron.weekly/ NORMAL
|
|
/etc/crontab$ NORMAL
|
|
/var/spool/cron/root/ CONTENT
|
|
/etc/anacrontab$ NORMAL
|
|
|
|
# time keeping
|
|
/etc/ntp.conf$ NORMAL
|
|
/etc/ntp/ NORMAL
|
|
/etc/chrony.conf$ NORMAL
|
|
/etc/chrony.keys$ NORMAL
|
|
|
|
# mail
|
|
/etc/aliases$ NORMAL
|
|
/etc/aliases.db$ NORMAL
|
|
/etc/postfix/ NORMAL
|
|
/etc/mail.rc$ NORMAL
|
|
/etc/mailcap$ NORMAL
|
|
|
|
# ssh
|
|
/etc/ssh/sshd_config$ NORMAL
|
|
/etc/ssh/ssh_config$ NORMAL
|
|
|
|
# stunnel
|
|
/etc/stunnel/ NORMAL
|
|
|
|
# ftp
|
|
/etc/vsftpd.conf$ CONTENT
|
|
/etc/vsftpd/ CONTENT
|
|
|
|
# printing
|
|
/etc/cups/ NORMAL
|
|
/etc/cupshelpers/ NORMAL
|
|
/etc/avahi/ NORMAL
|
|
|
|
# web server
|
|
/etc/httpd/ NORMAL
|
|
|
|
# dns
|
|
/etc/named/ NORMAL
|
|
/etc/named.conf$ NORMAL
|
|
/etc/named.iscdlv.key$ NORMAL
|
|
/etc/named.rfc1912.zones$ NORMAL
|
|
/etc/named.root.key$ NORMAL
|
|
|
|
# xinetd
|
|
/etc/xinetd.d/ NORMAL
|
|
|
|
# This gets new/removes-old filenames daily
|
|
!/var/log/sa
|
|
# As we are checking it, we've truncated yesterdays size to zero.
|
|
!/var/log/aide.log
|
|
|
|
# With AIDE's default verbosity level of 5, these would give lots of
|
|
# warnings upon tree traversal. It might change with future version.
|
|
#
|
|
#=/lost\+found DIR
|
|
#=/home DIR
|
|
|
|
# Ditto /var/log/sa reason...
|
|
!/var/log/httpd/ |