Faʻafefea ona faʻapipiʻi ma faʻaoga le AIDE (Advanced Intrusion Detection Environment) ile CentOS 8

A'o le'i amataina le vasega "Linux Pule" Ua matou saunia se faaliliuga o mea manaia.

AIDE o loʻo tu mo le "Advanced Intrusion Detection Environment" ma o se tasi o faiga sili ona lauiloa mo le mataʻituina o suiga i faiga faʻaogaina Linux. O lo'o fa'aogaina le AIDE e puipuia ai mai mea leaga, fa'ama'i ma su'esu'eina gaioiga e le fa'atagaina. Ina ia faʻamaonia le saʻo o faila ma iloa faʻalavelave, AIDE faia se faʻamaumauga o faʻamatalaga faila ma faʻatusatusa le tulaga o loʻo i ai nei o le faiga ma lenei faʻamaumauga. E fesoasoani le AIDE e faʻaitiitia le taimi o suʻesuʻega faʻalavelave e ala i le taulaʻi i faila ua suia.

vaega ole AIDE:

• Lagolagoina uiga eseese faila, e aofia ai: ituaiga faila, inode, uid, gid, faatagaga, numera o sootaga, mtime, ctime ma taimi.
• Lagolago mo le Gzip compression, SELinux, XAttrs, Posix ACL ma uiga faila faila.
• Lagolagoina algorithms eseese e aofia ai md5, sha1, sha256, sha512, rmd160, crc32, ma isi.
• Auina atu fa'amatalaga ile imeli.

I totonu o lenei tusiga, o le a tatou vaʻavaʻai pe faʻafefea ona faʻapipiʻi ma faʻaoga le AIDE mo le suʻeina o le faʻalavelave ile CentOS 8.

Mea e manaʻomia

• Server o loʻo faʻaogaina CentOS 8, faʻatasi ai ma le 2 GB o le RAM.
• maua'a

Amata

E fautuaina e fa'afou muamua le faiga. Ina ia faia lenei mea, taʻavale le poloaiga lenei.

dnf update -y

A mae'a fa'afou, toe amata lau faiga mo suiga e fa'atino.

Fa'apipi'i le AIDE

O loʻo maua le AIDE i le fale teu oloa CentOS 8. E faigofie ona e faʻapipiʻiina e ala i le faʻatinoina o le poloaiga lenei:

dnf install aide -y

A maeʻa le faʻapipiʻiina, e mafai ona e vaʻai i le AIDE version e faʻaaoga ai le poloaiga lenei:

aide --version

E tatau ona e vaʻai i mea nei:

Aide 0.16

Compiled with the following options:

WITH_MMAP
WITH_PCRE
WITH_POSIX_ACL
WITH_SELINUX
WITH_XATTR
WITH_E2FSATTRS
WITH_LSTAT64
WITH_READDIR64
WITH_ZLIB
WITH_CURL
WITH_GCRYPT
WITH_AUDIT
CONFIG_FILE = "/etc/aide.conf"

avanoa avanoa aide e mafai ona vaʻaia e pei ona taʻua i lalo:

aide --help

Fausia ma amataina le fa'amaumauga

O le mea muamua e tatau ona e faia pe a uma ona faʻapipiʻi le AIDE o le amataina lea. Initialization e aofia ai le fatuina o se database (snapshot) o faila uma ma directories i luga o le server.

Ina ia amataina le faʻamaumauga, faʻatautaia le poloaiga lenei:

aide --init

E tatau ona e vaʻai i mea nei:

Start timestamp: 2020-01-16 03:03:19 -0500 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz

Number of entries:	49472

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new.gz
  MD5      : 4N79P7hPE2uxJJ1o7na9sA==
  SHA1     : Ic2XBj50MKiPd1UGrtcUk4LGs0M=
  RMD160   : rHMMy5WwHVb9TGUc+TBHFHsPCrk=
  TIGER    : vkb2bvB1r7DbT3n6d1qYVfDzrNCzTkI0
  SHA256   : tW3KmjcDef2gNXYqnOPT1l0gDFd0tBh9
             xWXT2iaEHgQ=
  SHA512   : VPMRQnz72+JRgNQhL16dxQC9c+GiYB8g
             uZp6uZNqTvTdxw+w/IYDSanTtt/fEkiI
             nDw6lgDNI/ls2esijukliQ==


End timestamp: 2020-01-16 03:03:44 -0500 (run time: 0m 25s)

O le poloaiga o loʻo i luga o le a fatuina ai se faʻamaumauga fou aide.db.new.gz i le lisi /var/lib/aide. E mafai ona vaʻaia i le faʻaaogaina o le poloaiga lenei:

ls -l /var/lib/aide

Taunuʻuga:

total 2800
-rw------- 1 root root 2863809 Jan 16 03:03 aide.db.new.gz

E le fa'aogaina e le AIDE lenei faila fa'amaumauga fou se'i vagana ua toe fa'aigoaina i aide.db.gz. E mafai ona faia lenei mea e pei ona taua i lalo:

mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

E fautuaina e te fa'afouina lenei fa'amaumauga i lea taimi ma lea taimi ina ia mautinoa o lo'o mata'ituina lelei suiga.

E mafai ona e suia le nofoaga o le database e ala i le suia o le parakalafa DBDIR i faila /etc/aide.conf.

Fa'atino se su'ega

Ua sauni nei le AIDE e fa'aoga le fa'amaumauga fou. Fa'atino le siaki muamua AIDE e aunoa ma le faia o ni suiga:

aide --check

O lenei poloaiga o le a umi se taimi e faʻamaeʻa ai e faʻatatau i le tele o lau faila faila ma le aofaʻi o le RAM i lau 'auʻaunaga. A maeʻa le suʻega e tatau ona e vaʻai i mea nei:

Start timestamp: 2020-01-16 03:05:07 -0500 (AIDE 0.16)
AIDE found NO differences between database and filesystem. Looks okay!!

O lo'o ta'ua i luga e fa'apea o faila uma ma fa'atonuga e fetaui ma le fa'amaumauga a le AIDE.

Su'ega AIDE

Ona o le faaletonu, e le siaki e le AIDE le lisi o aʻa a Apache /var/www/html. Se'i tatou fa'atulaga le AIDE e matamata ai. Ina ia faia lenei mea e tatau ona e sui le faila /etc/aide.conf.

nano /etc/aide.conf

Faaopoopo i luga laina "/root/CONTENT_EX" mea nei:

/var/www/html/ CONTENT_EX

Sosoo ai, fai se faila aide.txt i le lisi /var/www/html/fa'aaoga le poloaiga lenei:

echo "Test AIDE" > /var/www/html/aide.txt

Faʻaauau le siaki AIDE ma ia mautinoa o loʻo maua le faila faila.

aide --check

E tatau ona e vaʻai i mea nei:

Start timestamp: 2020-01-16 03:09:40 -0500 (AIDE 0.16)
AIDE found differences between database and filesystem!!

Summary:
  Total number of entries:	49475
  Added entries:		1
  Removed entries:		0
  Changed entries:		0

---------------------------------------------------
Added entries:
---------------------------------------------------

f++++++++++++++++: /var/www/html/aide.txt

Matou te vaʻai ua iloa le faila na faia aide.txt.
A mae'a su'esu'ega suiga ua iloa, fa'afou le fa'amaumauga a le AIDE.

aide --update

A maeʻa le faʻafouga o le a e vaʻai i mea nei:

Start timestamp: 2020-01-16 03:10:41 -0500 (AIDE 0.16)
AIDE found differences between database and filesystem!!
New AIDE database written to /var/lib/aide/aide.db.new.gz

Summary:
  Total number of entries:	49475
  Added entries:		1
  Removed entries:		0
  Changed entries:		0

---------------------------------------------------
Added entries:
---------------------------------------------------

f++++++++++++++++: /var/www/html/aide.txt

O le poloaiga o loʻo i luga o le a fatuina ai se faʻamaumauga fou aide.db.new.gz i le lisi

/var/lib/aide/

E mafai ona e vaʻaia i le poloaiga lenei:

ls -l /var/lib/aide/

Taunuʻuga:

total 5600
-rw------- 1 root root 2864012 Jan 16 03:09 aide.db.gz
-rw------- 1 root root 2864100 Jan 16 03:11 aide.db.new.gz

Toe fa'aigoa nei le database fou ina ia fa'aogaina e le AIDE le database fou e siaki ai isi suiga. E mafai ona e toe faaigoa e faapea:

mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Toe fai le siaki ina ia mautinoa o loʻo faʻaogaina e le AIDE le faʻamaumauga fou:

aide --check

E tatau ona e vaʻai i mea nei:

Start timestamp: 2020-01-16 03:12:29 -0500 (AIDE 0.16)
AIDE found NO differences between database and filesystem. Looks okay!!

Matou te otometi le siaki

Ose manatu lelei le faia o se siaki AIDE i aso uma ma meli le lipoti. O lenei faiga e mafai ona otometi e faʻaaoga ai le cron.

nano /etc/crontab

Ina ia fa'atino le siaki AIDE i aso uma ile 10:15, fa'aopoopo le laina lea ile pito o le faila:

15 10 * * * root /usr/sbin/aide --check

Ole AIDE ole a logoina oe ile meli. E mafai ona e siaki lau meli i le poloaiga lenei:

tail -f /var/mail/root

E mafai ona vaʻaia le log AIDE e faʻaaoga ai le poloaiga lenei:

tail -f /var/log/aide/aide.log

iʻuga

I lenei tusiga, na e aʻoaʻoina ai le faʻaogaina o le AIDE e suʻe ai suiga o faila ma faʻailoa le avanoa e le faʻatagaina ai le server. Mo fa'aopoopoga fa'aopoopo, e mafai ona e fa'asa'o le faila fa'atulaga /etc/aide.conf. Mo mafuaaga saogalemu, e fautuaina e teu le faʻamaumauga ma faila faʻatulagaina i luga o faʻasalalauga faitau-naʻo. E mafai ona maua nisi fa'amatalaga i totonu o fa'amaumauga FESOASOANI Doc.

Aoao atili e uiga i le kosi.

puna: www.habr.com