I want to know what would be the minimum reference points to keep a eye on that shouldn't change daily?
Part of the answer depends on the box purpose. The "base" should be the dirs in your root $PATH that contain the system binaries, configuration files in /etc (and your distro's package management files shouldn't change w/o your approval).
I like to configure Aide to have separate config sets: one for system binaries, one for configs, one for jailed services etc etc. This allows you to check the various parts of the system independantly.
You should also recursively "chattr +iu" (immutable+undeletable) all dirs in your root $PATH that contain the system binaries, and chattr the configuration files that are not supposed to change, and "chattr +a" the logfiles (append-only: unset and reset for logrotation).
Also take care to save a copy of the databases (and preferably a statically linked Aide binary) on readonly media for verification purposes.
|