AIDE ?

3 Dec 2005

      Hi,

ich habe AIDE installiert und nach der Konfiguration einen --init gemacht.
Init legte also bei mir unter /tmp ein aide.db.new an. Diese hatte ich dannach
in /etc verschoben.

Folgendes /etc/cron.daily/ Script soll mir nur eine Mail schicken, wenn seit dem
letzten Check Änderungen zum vorhergehenden Check stattgefunden haben:

#!/bin/sh

aide -C > /tmp/aide.check.new

cat /tmp/aide.check.new | \
grep -Ev "database and filesystem!!|Start timestamp" > /tmp/aide.check.new1
mv /tmp/aide.check.new1 /tmp/aide.check.new

diff -u /tmp/aide.check /tmp/aide.check.new > /tmp/diff.txt

if [ $? != 0 ]; then
  echo =========================================== > /tmp/diff.msg
  echo Aide check found differences to last check. >> /tmp/diff.msg
  echo =========================================== >> /tmp/diff.msg

  cat /tmp/diff.txt >> /tmp/diff.msg
  echo =========================================== >> /tmp/diff.msg
  echo AIDE report >> /tmp/diff.msg
  echo =========================================== >> /tmp/diff.msg

  cat /tmp/aide.check.new >> /tmp/diff.msg
  cat /tmp/diff.msg | mail -s "Aide check changes !" lothar
  mv /tmp/aide.check.new /tmp/aide.check
  rm /tmp/diff.msg
fi

Warum geht das nicht ?

Danke, Lothar

Folgende Dateiänderungen bekomme ich immer wieder:

Dead symlink detected at /lib/modules/2.6.5-7.201-
default/source
Dead symlink detected at /usr/X11R6/bin/X
Dead symlink detected at 
/usr/share/apache2/build/config_vars.mk
Summary:
Total number of files=91800,added files=1,removed 
files=1,changed files=5

Added files:
added:/var/lib/pgsql/data/pg_xlog/000000000000001E
Removed files:
removed:/var/lib/pgsql/data/pg_xlog/000000000000001B
Changed files:
changed:/etc
changed:/etc/cups/certs
changed:/etc/cups/certs/0
changed:/etc/cron.daily
changed:/etc/aide.db
Detailed information about changes:

Directory: /etc
  Mtime    : 2005-12-03 14:44:25               , 2005-12-03 
15:25:41               
  Ctime    : 2005-12-03 14:44:25               , 2005-12-03 
15:25:41               

Directory: /etc/cups/certs
  Mtime    : 2005-12-03 15:18:47               , 2005-12-03 
16:03:47               
  Ctime    : 2005-12-03 15:18:47               , 2005-12-03 
16:03:47               

File: /etc/cups/certs/0
  Mtime    : 2005-12-03 15:18:47               , 2005-12-03 
16:03:47               
  Ctime    : 2005-12-03 15:18:47               , 2005-12-03 
16:03:47               
  MD5      : EFWXF4T7xgqlcpN7PiLQ4Q==          , 
pSTndFEaEdT7jDA6TcLq2g==          
  SHA1     : eCxv9DJwGlEW2nlT1Wlw73cj2Hs=      , 
/VNcAH8MvZaKul7tsb4hZWjCcyg=      

Directory: /etc/cron.daily
  Mtime    : 2005-12-03 15:21:18               , 2005-12-03 
15:25:54               
  Ctime    : 2005-12-03 15:21:18               , 2005-12-03 
15:25:54               

File: /etc/aide.db
  Size     : 13402434                          , 13402578                          
  Mtime    : 2005-12-03 14:43:52               , 2005-12-03 
15:25:00               
  Ctime    : 2005-12-03 14:44:25               , 2005-12-03 
15:25:41               
  Inode    : 105030                            , 109643                            
  MD5      : 2/Rw2lqtKskDfPq+zpBdIQ==          , 
F+2xQ7Luj9sxBIBEopl8wA==          
  SHA1     : P5gaTySlz8GXSUmtNfOBdsPFMt0=      , 
bRg4RIWVzJiOM/Jd6M2bjLAVEWU=      

-- 
Lothar Behrens	|	Rapid Prototyping ...
Rosmarinstr 3		|	
40235 Düsseldorf  	|	www.lollisoft.de

AIDE ?

lothar.behrens＠lollisoft.de