{"id":3768,"date":"2019-03-13T22:11:06","date_gmt":"2019-03-13T16:41:06","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=3768"},"modified":"2019-03-13T22:15:59","modified_gmt":"2019-03-13T16:45:59","slug":"how-to-set-up-aide-advanced-intrusion-detection-environment","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/how-to-set-up-aide-advanced-intrusion-detection-environment\/","title":{"rendered":"HOW TO SET UP AIDE &#8211; ADVANCED INTRUSION DETECTION ENVIRONMENT"},"content":{"rendered":"\n<h4 class=\"wp-block-heading\">HOW TO SET UP AIDE &#8211; ADVANCED INTRUSION DETECTION ENVIRONMENT<\/h4>\n\n\n\n<h4 class=\"wp-block-heading\">Date Posted: 13\/03\/2019<\/h4>\n\n\n\n<h4 class=\"wp-block-heading\">Introduction<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Aide also called as Advanced Intrusion Detection Environment is an open source host based file and directory integrity checker. <br><br> It is very usefull when someone placing a backdoor on your web site and make changes that may take your system down completely. <\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Functionality<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Aide creates a database from your filesystem and stores various file attributes like permissions, inode number, user, group, file size, mtime and ctime, atime, growing size, number of links and link name.<br><br> When someone make changes in filesystem, then Aide compare the database against the real status of the system and report it to server administrator. <br><br><br><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img fetchpriority=\"high\" decoding=\"async\" width=\"768\" height=\"480\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Monitoring.png\" alt=\"\" class=\"wp-image-3773\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Monitoring.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Monitoring-300x188.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Monitoring-400x250.png 400w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we will go through step by step instruction of how to install and use AIDE on centos -7 ambience.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Method 1<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\">1. Install AIDE<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code># yum install aide<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Press y <\/strong>on the terminal to proceed with the installation.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">2. Check Version.<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore  the installation  comletes successfully.<br><br>After that,  verify  the aide version using below command.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># aide -v<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The output will show the version like below reference snapshot<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"784\" height=\"650\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.15.05-PM.png\" alt=\"\" class=\"wp-image-3774\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.15.05-PM.png 784w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.15.05-PM-300x249.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.15.05-PM-768x637.png 768w\" sizes=\"(max-width: 784px) 100vw, 784px\" \/><\/figure>\n\n\n\n<h5 class=\"wp-block-heading\">3. Generate a aide database.<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">You can use the default files as provided in the config file using <strong>\/etc\/aide.conf              <\/strong><br>Once changes to <strong>aide.conf <\/strong>file have been finalised.  However,  generate the database, using following command<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># aide \u2014 init<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For instance,  the database has been successfully created, you can see a message on the console as shown below-<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" width=\"1024\" height=\"111\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.25.00-PM-1024x111.png\" alt=\"\" class=\"wp-image-3775\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.25.00-PM-1024x111.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.25.00-PM-300x33.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.25.00-PM-768x84.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.25.00-PM.png 1176w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The database is created in location&nbsp;<strong>\/var\/lib\/aide\/aide.db.new.gz<\/strong>.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">4. Move the database<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\"> The database must be moved to location of<strong>\/var\/lib\/aide\/aide.db.gz<\/strong> .<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#mv \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">5. you can issue the check command <\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">This will take some time to execute.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># aide\u2013check<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"> Similarly, if all the files gets match, then you will see the following message on the console:<\/p>\n\n\n\n<ul class=\"wp-block-gallery columns-1 is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\"><li class=\"blocks-gallery-item\"><figure><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"123\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.40.56-PM-1024x123.png\" alt=\"\" data-id=\"3776\" data-link=\"https:\/\/pheonixsolutions.com\/blog\/?attachment_id=3776\" class=\"wp-image-3776\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.40.56-PM-1024x123.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.40.56-PM-300x36.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.40.56-PM-768x92.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-13-at-7.40.56-PM.png 1084w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/li><\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Method  2<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Single-line command to perform all of the above steps:<br><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yum install aide -y &amp;&amp; \/usr\/sbin\/aide \u2013init &amp;&amp; cp \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz &amp;&amp; \/usr\/sbin\/aide \u2013c<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, schedule cron activity.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \u201c05 5 * * * root \/usr\/sbin\/aide \u2013check\u201d >> \/etc\/crontab<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s it. Thanks for using Pheonix solutions.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>HOW TO SET UP AIDE &#8211; ADVANCED INTRUSION DETECTION ENVIRONMENT Date Posted: 13\/03\/2019 Introduction Aide also called as Advanced Intrusion [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1022],"tags":[581,260],"class_list":["post-3768","post","type-post","status-publish","format-standard","hentry","category-web-architecture","tag-intrusion-detection","tag-server-hardening","psol-cat-web-architecture"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-YM","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=3768"}],"version-history":[{"count":0,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/3768\/revisions"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=3768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=3768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=3768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}