AIDE Ubuntu Installation

AIDE Rules

As I mentioned before, all of the rules by default will be in each of the files in the

/etc/aide/aide.conf.d/

directory.

The rules listed in these files won't show up in

/etc/aide/aide.conf

until you run the

update-aide.conf

command.

So before we run that command, we'll want to pick and choose whichever rules we'll want to apply to our system.

As an example, we'll set up AIDE to monitor the directories that the web service,

Apache2 installs on the system.

Under

the /etc/aide/aide.conf.d/

directory, we have a few files that match this description:

/etc/aide/aide.conf.d/31_aide_libapache2-mod-fastcgi
/etc/aide/aide.conf.d/31_aide_apache2
/etc/aide/aide.conf.d/30_aide_apache2

The

31_aide_apache2

contains a few rules containing the log files that Apache2 creates. However, for our example, we'll want AIDE to also watch the configuration directories to make sure nobody is changing the files on the system.

Before we configure the Apache2 files directly, let's move the rest of the files out of the way so AIDE will only add rules that will fulfill our needs:

mkdir /etc/aide/unused-config-files
for FILE in $(ls -arth /etc/aide/aide.conf.d | grep -viE "apache2|aide$"); do mv /etc/aide/aide.conf.d/${FILE} /etc/aide/unused-config-files/; done

With these commands, we'll create a directory and move all files that do not specifically reference the Apache2 service or AIDE into that directory.

Now onto editing the contents of the Apache2 files. Within

/etc/aide/aide.conf.d/31_aide_apache2

we can find:

@@ifdef APACHE2_SUEXEC
@@define APACHE2_LOGS (access|error|suexec)
@@else
@@define APACHE2_LOGS (access|error)
@@endif
/var/log/apache2/@@{APACHE2_LOGS}\.log$ Log
/var/log/apache2/@@{APACHE2_LOGS}\.log\.1$ LowLog
/var/log/apache2/@@{APACHE2_LOGS}\.log\.2\.gz$ LoSerMemberLog
/var/log/apache2/@@{APACHE2_LOGS}\.log\.([3-9]|[1-4][0-9]|5[0-1])\.gz$ SerMemberLog
/var/log/apache2/@@{APACHE2_LOGS}\.log\.52\.gz$ HiSerMemberLog

/@@{RUN}/apache2\.pid$ VarFile
/@@{RUN}/apache2/ssl_scache$ VarFile
/var/log/apache2$ VarDir
/@@{RUN}/apache2$ VarDirInode

So let's break down this file first before we add our own rule to it.

The first 5 lines of the file use the @@ symbols and go over setting a variable that can be used within all other AIDE configuration files. You can view the documentation for these specific macros (as they are called) here:
http://manpages.ubuntu.com/manpages/bionic/man5/aide.conf.5.html#macro%20lines

We can see that the if/else condition first checks to see if the

APACHE2_SUEXEC

variable is set which is all the

file 30_aide_apache2

does. So, as long as that file stays enabled, the file we're editing will not have any problems.

You'll see within the if/else statements the use of

define

which is how you set the variables. Within the file, it sets the variable

APACHE2_LOGS

to be both

access

and

error

whenever it is called.

So applying what we know, this variable is used to have AIDE look at both the

/var/log/apache2/error.log

and

/var/log/apache2/access.log

files with the log-specific definitions, which can be found in

/etc/aide/aide.conf

A few of the next lines after those use

@@{RUN}

which is created by the 10-aide-run config file and simply translates to run.

So with all of the contents of the file explained, let's create our own rule to the bottom of the file.

@@define SITES (sites-available|sites-enabled)
/etc/apache2/@@{SITES} Checksums

First, we define

SITES

to resolve to both

sites-available

and

sites-enabled.

Both of these values come from the directories that Apache2 creates to sort out which configuration files are enabled or are simply just available.

Then, we use this newly-created variable when specifying the Apache2 configuration directory so that it knows where to look. If we wanted to exclude the directory, we would put ! in front of the directory and leave out the group definition like this:

!/etc/apache2/@@{SITES}

Since we're wanting to monitor the directory for changes within the files, we'll add

Checksums

definition onto the end.

Now that we've created our rules, we can move on to initializing the database.

For these rules files, you can just create a file, place the rules in it, and name it whatever you want as long as the file is within the

/etc/aide/aide.conf.d/

directory. You can also add the rules to the

/etc/aide/aide.conf

directory but only use this for testing as all changes get overwritten when you run the

update-aide.conf

command.