|
cvsextras |
9fe78c |
# Example configuration file for AIDE.
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
@@define DBDIR /var/lib/aide
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# The location of the database to be read.
|
|
cvsextras |
9fe78c |
database=file:@@{DBDIR}/aide.db.gz
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# The location of the database to be written.
|
|
cvsextras |
9fe78c |
#database_out=sql:host:port:database:login_name:passwd:table
|
|
cvsextras |
9fe78c |
#database_out=file:aide.db.new
|
|
cvsextras |
9fe78c |
database_out=file:@@{DBDIR}/aide.db.new.gz
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# Whether to gzip the output to database
|
|
cvsextras |
9fe78c |
gzip_dbout=yes
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# Default.
|
|
cvsextras |
9fe78c |
verbose=5
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
report_url=file:/var/log/aide.log
|
|
cvsextras |
9fe78c |
report_url=stdout
|
|
cvsextras |
9fe78c |
#report_url=stderr
|
|
cvsextras |
9fe78c |
#NOT IMPLEMENTED report_url=mailto:root@foo.com
|
|
cvsextras |
9fe78c |
#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# These are the default rules.
|
|
cvsextras |
9fe78c |
#
|
|
cvsextras |
9fe78c |
#p: permissions
|
|
cvsextras |
9fe78c |
#i: inode:
|
|
cvsextras |
9fe78c |
#n: number of links
|
|
cvsextras |
9fe78c |
#u: user
|
|
cvsextras |
9fe78c |
#g: group
|
|
cvsextras |
9fe78c |
#s: size
|
|
cvsextras |
9fe78c |
#b: block count
|
|
cvsextras |
9fe78c |
#m: mtime
|
|
cvsextras |
9fe78c |
#a: atime
|
|
cvsextras |
9fe78c |
#c: ctime
|
|
cvsextras |
9fe78c |
#S: check for growing size
|
|
cvsextras |
9fe78c |
#md5: md5 checksum
|
|
cvsextras |
9fe78c |
#sha1: sha1 checksum
|
|
cvsextras |
9fe78c |
#rmd160: rmd160 checksum
|
|
cvsextras |
9fe78c |
#tiger: tiger checksum
|
|
cvsextras |
9fe78c |
#haval: haval checksum
|
|
cvsextras |
9fe78c |
#gost: gost checksum
|
|
cvsextras |
9fe78c |
#crc32: crc32 checksum
|
|
cvsextras |
9fe78c |
#R: p+i+n+u+g+s+m+c+md5
|
|
cvsextras |
9fe78c |
#L: p+i+n+u+g
|
|
cvsextras |
9fe78c |
#E: Empty group
|
|
cvsextras |
9fe78c |
#>: Growing logfile p+u+g+i+n+S
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# You can create custom rules like this.
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
NORMAL = R+b+sha1
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
DIR = p+i+n+u+g
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# Next decide what directories/files you want in the database.
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
/boot NORMAL
|
|
cvsextras |
9fe78c |
/bin NORMAL
|
|
cvsextras |
9fe78c |
/sbin NORMAL
|
|
cvsextras |
9fe78c |
/lib NORMAL
|
|
cvsextras |
9fe78c |
/opt NORMAL
|
|
cvsextras |
9fe78c |
/usr NORMAL
|
|
cvsextras |
9fe78c |
/root NORMAL
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# Check only permissions, inode, user and group for /etc, but
|
|
cvsextras |
9fe78c |
# cover some important files closely.
|
|
cvsextras |
9fe78c |
/etc p+i+u+g
|
|
cvsextras |
9fe78c |
!/etc/mtab
|
|
cvsextras |
9fe78c |
/etc/exports NORMAL
|
|
cvsextras |
9fe78c |
/etc/fstab NORMAL
|
|
cvsextras |
9fe78c |
/etc/passwd NORMAL
|
|
cvsextras |
9fe78c |
/etc/group NORMAL
|
|
cvsextras |
9fe78c |
/etc/gshadow NORMAL
|
|
cvsextras |
9fe78c |
/etc/shadow NORMAL
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
/var/log p+n+u+g
|
|
cvsextras |
9fe78c |
|
|
cvsextras |
9fe78c |
# With AIDE's default verbosity level of 5, these would give lots of
|
|
cvsextras |
9fe78c |
# warnings upon tree traversal. It might change with future version.
|
|
cvsextras |
9fe78c |
#
|
|
cvsextras |
9fe78c |
#=/lost\+found DIR
|
|
cvsextras |
9fe78c |
#=/home DIR
|
|
cvsextras |
9fe78c |
|