AIDE

lattimro · 04-11-2022, 06:52 AM

Hi All,

Code:

System: Kernel: 5.13.0-39-generic x86_64 bits: 64 Desktop: Xfce 4.16.0 
           Distro: Ubuntu 21.10 (Impish Indri) 

Aide 0.17.3

AIDE installed from apt.

Code:

dpkg -l |g aide
ii  aide                                          0.17.3-4ubuntu0.1                          amd64        Advanced Intrusion Detection Environment - static binary
ii  aide-common                                   0.17.3-4ubuntu0.1                          all          Advanced Intrusion Detection Environment - Common files

I am not sure if anybody still uses AIDE, I used in the past and everything was straightforward. For some reasons this time I have some issues and I hope someone knows something and can identify this behaviour.
This is default conf. Creating aide.db takes 241'6" and but when I launch any aide command with I received an error like below.

I purged and reinstalled few times but this behaviour persisted.

Code:

# aideinit -y
Running aide --init...
WARNING: get_file_status: lstat() failed for /run/user/1000/doc: Permission denied
WARNING: get_file_status: lstat() failed for /run/user/1000/gvfs: Permission denied
Start timestamp: 2022-04-10 18:11:15 -0400 (AIDE 0.17.3)
AIDE initialized database at /var/lib/aide/aide.db.new

Number of entries:	913979

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new
...................................................
...................................................

End timestamp: 2022-04-10 22:12:21 -0400 (run time: 241m 6s)
Overwrite /var/lib/aide/aide.db [yN]? y
You have new mail in /var/mail/root

Code:

# aide --check
  ERROR: missing configuration (use '--config' '--before' or '--after' command line parameter)
You have new mail in /var/mail/root

Code:

# ll
total 205192
drwxr-xr-x   2 root root      4096 Apr 10 17:08 ./
drwxr-xr-x 107 root root      4096 Apr 10 07:24 ../
-rw-------   1 root root 210107699 Apr 10 22:44 aide.db
-rw-------   1 root root         0 Apr 11 07:05 aide.db.new

Thanks so much guys!

smallpond · 04-11-2022, 07:57 AM

What is in /etc/aide/aide.conf?

lattimro · 04-11-2022, 08:23 AM

Quote:

Originally Posted by smallpond

What is in /etc/aide/aide.conf?

default config, do you want to post it?

smallpond · 04-11-2022, 10:27 AM

You got one error: "ERROR: missing configuration" so either file isn't where it is expected or permissions are wrong.

lattimro · 04-11-2022, 10:43 AM

Quote:

Originally Posted by smallpond

You got one error: "ERROR: missing configuration" so either file isn't where it is expected or permissions are wrong.

Code:

ll
total 40
drwxr-xr-x   4 root root  4096 Apr 11 09:32 ./
drwxr-xr-x 199 root root 12288 Apr 10 16:42 ../
-rw-r--r--   1 root root  6802 May 13  2021 aide.conf
drwxr-xr-x   2 root root 12288 Mar  7 20:15 aide.conf.d/
drwxr-xr-x   2 root root  4096 Mar  7 20:14 aide.settings.d/

Code:

aide --init --config=/etc/aide/aide.conf
  ERROR: /etc/aide/aide.conf:145: 'verbose' option is no longer supported, use 'log_level' and 'report_level' options instead (see man aide.conf for details) (line: '!/var/spool/.*')

Code:

139
140 # Ignore logs
141 !/var/lib/pacman/.*
142 !/var/cache/.*
143 !/var/log/.*
144 !/var/run/.*
145 !/var/spool/.*
146

p1r4t3 · 10-27-2023, 04:35 AM

Hello,

I'm looking to keep a trace all the files copied to a USB key, I came accross AIDE.

My first question is : Is it the best tool to do this ?

If it's the case, @lattimro, do you manage to fix your problem ? I had the same error, but I didn't wait long enough for the command to finish

I saw that you had to wait more than 4 hours. I re run the command, I'm currently waiting...

Thanks

lattimro · 10-30-2023, 08:48 PM

Quote:

Originally Posted by p1r4t3

Hello,

I'm looking to keep a trace all the files copied to a USB key, I came accross AIDE.

My first question is : Is it the best tool to do this ?

If it's the case, @lattimro, do you manage to fix your problem ? I had the same error, but I didn't wait long enough for the command to finish

I saw that you had to wait more than 4 hours. I re run the command, I'm currently waiting...

Thanks

Yes, I remember I waited even days. It works on other distributions. On Ubuntu perhaps I disabled it due to errors, I can't remember now. I will install and run it again and let you know.

I installed, the same errors