AIDE (Advanced Intrusion Detection Environment)
AIDE is a Host-Based Intrusion Detection System (HIDS), a free alternative to
Tripwire (if you already know Tripwire you should have no difficulties learning
the configuration file for AIDE). HIDS are used to detect changes to important
system configuration files and binaries, generally by making a unique
cryptographic hash for the files to be checked and storing it in a secure
place. On a regular basis (such as once a day), the stored "known-good" hash is
compared to the one generated from the current copy of each file, to determine
if that file has changed. HIDS are a great way to detect disallowed changes to
your system, but they take a little work to implement properly and make good use
The configuration file is based on regular expressions, macros and rules for
files and directories. We have the following macros:
||If not defined
||Define a variable
||@@define "name" "value"
||Undefine a variable
||if not "hostname"
Endif must be used after any of the above macros except define and undef
These macros become very handy if you have more than one Gentoo box and want to
use AIDE on all of them. But not all machines run the same services or even have
the same users.
Next we have sets of flags to check for on files and directories. These are a
combination of permissions, file properties and cryptographic hashes
||number of links
||check for growing size
||Growing logfile p+u+g+i+n+S
And if AIDE is compiled with mhash support it supports a few other features:
Now you can create you own rules based on the above flags by combining them
Code Listing 1.1: Create a ruleset for AIDE
The last thing we need to create our own configuration file is to see how to add
a rule to a file or directory. To enter a rule, combine the file or directory
name and the rule. AIDE will add all files recursively unless you specify an
||Don't add this file or directory.
||Add this directory, but not recursively.
So lets watch a full blown example:
Code Listing 1.1: /etc/aide/aide.conf
@@define TOPDIR /
@@define AIDEDIR /etc/aide
# The location of the database to be read.
# The location of the database to be written.
# Rule definition
In the above example we specify with some macros where the topdir starts and
where the AIDE directory is. AIDE checks the /etc/aide/aide.db file
when checking for file integrity. But when updating or creating a new file it
stores the information in /etc/aide/aide.db.new. This is done so it
won't automatically overwrite the old db file. The option
report_URL is not yet implemented, but the author's intention was that
it should be able to e-mail or maybe even execute scripts.
The AIDE ebuild now comes with a working default configuration file, a helper
script and a crontab script. The helper script does a number of tasks for you
and provides an interface that is a little more script friendly. To see all
available options, try aide --help. To get started, all that needs to be
done is aide -i and the crontab script should detect the database and
send mails as appropriate every day. We recommend that you review the
/etc/aide/aide.conf file and ensure that the configuration
accurately reflects what is in place on the machine.
Depending on your CPU, disk access speed, and the flags you have set on files,
this can take some time.
Remember to set an alias so you get roots mail. Otherwise you will never know
what AIDE reports.
Now there is some risk inherent with storing the db files locally, since the
attacker will (if they know that AIDE is installed) most certainly try to alter
the db file, update the db file or modify /usr/bin/aide. So you
should create a CD or other media and put on it a copy of the .db file and the
One can find information at the AIDE project page.
Snort is a Network Intrusion Detection System (NIDS). To install and configure
it use the following examples.
Code Listing 1.1: /etc/conf.d/snort
SNORT_OPTS="-D -s -u snort -dev -l $LOGDIR -h $NETWORK -c $CONF"
Code Listing 1.1: /etc/snort/snort.conf
var HOME_NET 10.0.0.0/24
var EXTERNAL_NET any
var SMTP $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var DNS_SERVERS [10.0.0.2/32,188.8.131.52/32]
var RULE_PATH ./
preprocessor stream4: detect_scans detect_state_problems detect_scans disable_evasion_alerts
preprocessor stream4_reassemble: ports all
preprocessor http_decode: 80 8080 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
preprocessor rpc_decode: 111 32771
preprocessor bo: -nobrute
# include $RULE_PATH/experimental.rules
Code Listing 1.1: /etc/snort/classification.config
config classification: not-suspicious,Not Suspicious Traffic,3
config classification: unknown,Unknown Traffic,3
config classification: bad-unknown,Potentially Bad Traffic, 2
config classification: attempted-recon,Attempted Information Leak,2
config classification: successful-recon-limited,Information Leak,2
config classification: successful-recon-largescale,Large Scale Information Leak,2
config classification: attempted-dos,Attempted Denial of Service,2
config classification: successful-dos,Denial of Service,2
config classification: attempted-user,Attempted User Privilege Gain,1
config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
config classification: successful-user,Successful User Privilege Gain,1
config classification: attempted-admin,Attempted Administrator Privilege Gain,1
config classification: successful-admin,Successful Administrator Privilege Gain,1
# NEW CLASSIFICATIONS
config classification: rpc-portmap-decode,Decode of an RPC Query,2
config classification: shellcode-detect,Executable code was detected,1
config classification: string-detect,A suspicious string was detected,3
config classification: suspicious-filename-detect,A suspicious filename was detected,2
config classification: suspicious-login,An attempted login using a suspicious username was detected,2
config classification: system-call-detect,A system call was detected,2
config classification: tcp-connection,A TCP connection was detected,4
config classification: trojan-activity,A Network Trojan was detected, 1
config classification: unusual-client-port-connection,A client was using an unusual port,2
config classification: network-scan,Detection of a Network Scan,3
config classification: denial-of-service,Detection of a Denial of Service Attack,2
config classification: non-standard-protocol,Detection of a non-standard protocol or event,2
config classification: protocol-command-decode,Generic Protocol Command Decode,3
config classification: web-application-activity,access to a potentially vulnerable web application,2
config classification: web-application-attack,Web Application Attack,1
config classification: misc-activity,Misc activity,3
config classification: misc-attack,Misc Attack,2
config classification: icmp-event,Generic ICMP event,3
config classification: kickass-porn,SCORE! Get the lotion!,1
More information is at the Snort web site.
Detecting malware with chkrootkit
HIDS like AIDE are a great way to detect changes to your system, but it never
hurts to have another line of defence. chkrootkit is a utility that scans
common system files for the presence of rootkits--software designed to hide an
intruder's actions and allow him to retain his access--and scans your system for
likely traces of key loggers and other "malware". While chkrootkit (and
alternatives like rkhunter) are useful tools, both for system
maintenance and for tracking an intruder after an attack has occurred, they
cannot guarantee your system is secure.
The best way to use chkrootkit to detect an intrusion is to run it
routinely from cron. To start, emerge
app-forensics/chkrootkit. chkrootkit can be run from the
command line by the command of the same name, or from cron with an entry
such as this:
Code Listing 1.1: Schedule chkrootkit as a cronjob
0 3 * * * /usr/sbin/chkrootkit
Page updated July 19, 2010
Donate to support our development efforts.