Questions tagged [aide]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
57 views

Aide Does not Write aide.db After Successful Scan

I have installed aide on Ubuntu 22.04 and left the default configuration. After it ran, I got an email report that indicates that everything went smooth. See the report below. The /var/lib/aide/aide....
Christopher's user avatar
0 votes
1 answer
43 views

Show changes with diff using AIDE

is it possible to compare the changed file when using AIDE? In the automatic Email only the SHA256 will be compared. It would be pretty cool if i can see what changed, maybe with a diff or something. ...
vanishedd's user avatar
0 votes
1 answer
1k views

update-aide.conf command not found

I'm trying to setup aide IDS on my ubuntu server, I followed the official installation guide but when I try to use the command "update-aide.conf" to generate new config I get error $ update-...
Bekr's user avatar
  • 3
1 vote
1 answer
303 views

Interpreting flags in AIDE daily report

My questions is about the flags displayed by AIDE for each file in daily email reports. For example for new files its shows as follows: f++++++++++++++++: /var/cache/apt/archives/squashfs-tools_1%3a4....
Xuo Guoto's user avatar
2 votes
0 answers
29 views

Does AIDE support scanning memfd files?

Happy to be here with my first question! I am using AIDE for file integrity checking. Today I came across an article which details a technique to run malware droppers without touching file system, by ...
Xuo Guoto's user avatar
0 votes
1 answer
724 views

How to install `aide` without `aide-common` in debian?

Per this post, Newer versions of Ubuntu (including 14.04) come with two packages for AIDE: aide, with the aide command and manual page, and little else aide-common, with a wrapper around that ...
kittygirl's user avatar
  • 955
0 votes
1 answer
186 views

Getting the same email at the same time from [email protected]. Not sure where it came from

I created an AIDE script that able to monitor file changes in my hosting, and when something file has changed, it will send an alert email about the changes. In my opinion, I don't think the script ...
MaXi32's user avatar
  • 367
0 votes
0 answers
14 views

After AIDE check, the buff/cache is full in CENTOS7 [duplicate]

I have configured AIDE (Advanced Intruder Detection Environment) in my Centos7 VPS which has 2GB of RAM. After running AIDE --check I get the desired or the intended result. But when I check the ...
Chin. Udara's user avatar
1 vote
1 answer
447 views

AIDE reporting file additions to folder marked ACL only

I have a server configured with AIDE and I'm trying to tune out false positives. I received an alert this morning that a file had been added to a folder that I believe should only alert on ACL changes,...
ebarrere's user avatar
  • 330
1 vote
1 answer
235 views

SELinux: AIDE Trying to Access SSSD Socket

I'm getting SELinux denials indicating that /usr/sbin/aide is trying to access a socket used by SSSD: the socket path is /var/lib/sss/pipes/nss. Here is the relevant text from sealert: Additional ...
Nester's user avatar
  • 31
0 votes
1 answer
215 views

Salt-Stack init process after package is installed

Installing AIDE needs to follow by a init proces. aide: pkg: - installed Now the following commands need to run only once: /usr/sbin/aide --config=/etc/aide.conf --init mv -f /var/lib/aide/aide.db....
BdK's user avatar
  • 1
-1 votes
1 answer
298 views

Installing AIDE in Alpine

I'm trying to make my Alpine instance more secure by installing AIDE but it doesn't seem to be in the repos: #apk add aide fetch http://dl-cdn.alpinelinux.org/alpine/v3.8/main/x86_64/APKINDEX.tar.gz ...
user3333099's user avatar
0 votes
1 answer
36 views

Cannot run an "initialise" function in Puppet after installing package

OK I have been working on puppet for 12 months, I am deploying a manifest to install the "aide" package, but I cannot see any option to trigger the 'initialise' of aide after install of the package. ...
Robert Osbourne's user avatar
0 votes
3 answers
4k views

cron job executing script not writing to file

I have a server running AIDE, and a cron job that runs executes a bash script and sends an email alert out. It is still a WIP, but I can't get the script to run properly. When the script is executed, ...
popopanda's user avatar
  • 201
0 votes
1 answer
1k views

AIDE Self Protection - Best Practices

I set up a pretty simple server and tried to make it secure using some tools and some guidelines which I think are not too bad. I came up using AIDE, which is fast as an implementation of an ...
maxik's user avatar
  • 111
4 votes
1 answer
2k views

Auditing in linux

I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like auditd aide psacct But none is full filling my requirement. My requirement ...
thinkingmonster's user avatar
3 votes
1 answer
5k views

How do I interpret aide.log change summary

In the Changed files section of /var/log/aide/aide.log there are prefixes on each line starting with f or d. These signify what aspects of the file has changed, but I can't seem to track down what ...
Alastair Irvine's user avatar
0 votes
1 answer
2k views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
akalenuk's user avatar
  • 553
2 votes
1 answer
966 views

Analyse of logwatch and aide file

We have both logwatch and aide file. We would like to know how to know if there any intrusion have had taken place as this server was not active for some time. We quite a number of this entries in the ...
user132638's user avatar
5 votes
1 answer
13k views

AIDE - How to exclude whole folders?

I've recently installed AIDE on a server of mine after having a run in with hackers a week or so ago. There doesn't appear to be much documentation around for AIDE, especially on their website. I've ...
goji's user avatar
  • 255
3 votes
2 answers
6k views

aide --init show lots of errors

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or ...
newbie14's user avatar
  • 149