AIDE File Integrity Scanner

What is AIDE ?

AIDE is A file integrity scanner is something you need to have.  Imagine a hacker placing a backdoor on your web site, or changing your order form to email him a copy of everyone's credit card while leaving it appear to be functionally normally.

By setting up daily reporting, this notifies you within, at most, 24 hours of when any file was changed, added, or removed.  It also helps establish an audit trail in the event your site is compromised.

These instructions are designed for an end user, where you don't need to have root access, to implement and assumes your server has the aide binary installed.  Most hosts will have this installed already, or will install it for you upon request.

Install AIDE

#zypper in aide

Download A Sample AIDE config file

We will start with a simple one, this will scan your web root directory for md5 hash changes.

To download the file, SSH into your account and run:

#cd /home/testing
#wget http://repository.wowtutorial.org/aide.conf

Example

Our username is : testing and the home directory is /home/testing/public_html

Edit aide.conf
#vi aide.conf

What you will want to change in this file, is replace "username" on the first line, and confirm that is the path to your root directory.
Then on the last line, confirm that public_html is your web root directory.  If your host uses the cPanel control panel, then public_html is your web root.

in this case then change it the username to "testing" and leave the public_html untouch since testing home directory is in /home/testing/public_html

Initialize the AIDE database

The command to initialize the AIDE database is:

#nice -19 aide --init --config=/home/testing/aide.conf

AIDE is not the least resource intensive software in the world so we are running it with a 19 priority using nice.

Now copy your AIDE output database file to the input file:

#cp aide.db.out aide.db.in

You can test aide by doing:

#nice -19 aide -C --config=/home/testing/aide.conf

Go ahead and run that now, it will say all files match, then make a change to a file and add a file, rerun it and see what the report says.

Daily Reporting with Cronjob

There are a few ways to get the aide reports, a common one is to have it email you the reports, for this you can set a cronjob to run aide everyday, or even more frequently if you'd like.

Open up the crontab editor and paste in:

#crontab -e

0 1 * * * nice -19 /usr/local/bin/aide --config=/home/testing/aide.conf -C| mail you@domain.com -saide\ domain

The reports can get rather lengthy overtime, so if you want to reset the database, say weekly, you can add this to the crontab:

#0 2 * * 0  nice -19 /usr/local/bin/aide --config=/home/testing/aide.conf --init;mv -f /home/testing/aide.db.out /home/testing/aide.db.in

Extras

We have covered the basics, and that is actually only the tip of the iceberg of what you can do with AIDE.


And you might want to exclude certain files, for example if you have a forum or gallery and a lot of images are added regularly you can exclude those from the report. For example to exclude all jpg files in images/ you would put the following in the config file:

#vi /home/testing/aide.conf
....
....
!@@{TOPDIR}/public_html/images/.*\.jpg$
...

And that would go right above this line:
@@{TOPDIR}/public_html MD

Another thing you can do for extra security is, have your host chown your in database file, and your config file to another user, this way if your user is compromised, the hacker could not compromise your AIDE database, without also gaining access to the second user.

To be even more secure, you can download your AIDE database after creating it, and then upload it before you run a scan.

I hope this Howto lets you see the need for a file integrity checker, and makes it easy to setup, no matter what your user level is.