Configuring a host-based intrusion detection system (IDS) on CentOS6.5

Last Update:2016-03-23 Source: Internet

Author: User

Tags add time unsupported gstreamer

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Project background:

AIDE ("Advanced Intrusion Detection Environment" abbreviation) is an open source host-based intrusion detection system. Aide checks the integrity of the system binaries and basic configuration files by examining the inconsistency of a large number of file attributes, including permissions, file types, index nodes, links, link names, users, groups, file size, block count, modification time, add time, creation time, ACL, Various features, including the SELinux security context, Xattrs, and Md5/sha checksum values.

Aide builds a file property database by scanning a file system of a (unmodified) Linux server, then proofreading the server file properties against the database, and then warns the modified indexed files when the server is running. For this reason, aide must re-index the protected file after the system has been updated or its configuration file has been legitimately modified.

Lab Environment:

VMware Workstation 11

Under the centos6.5 system

Server: ip:192.168.0.57

Aide-0.14-7.el6.x86_64

SECURECRT (SSH remote connection software)

Usually we need a clean environment on the newly installed system!

Experimental process

First, the software download

[email protected] ~]# Yum install aide-y

Second, the software downloaded successfully after the network shutdown

[[Email protected] ~]# service network stop

Third, aide database initialization

[email protected] desktop]# aide--init

AIDE, version 0.14

# # # AIDE Database at/var/lib/aide/aide.db.new.gz initialized.

Four, the database file rename, otherwise the words aide can't read out

[Email protected] desktop]# mv/var/lib/aide/aide.db.new.gz/var/lib/aide/aide.db.gz

V. Software inspection

Enter aide directly at the command line (input will wait a long time ~ ~ ~)

[email protected] desktop]# Aide

AIDE found differences between database and filesystem!!

Start timestamp:2016-03-22 03:09:05

Summary:

Total number of files:85618

Added files:0

Removed files:0

Changed files:39

---------------------------------------------------

Changed files:

---------------------------------------------------

Changed:/usr/sbin

Changed:/usr/libexec

Changed:/usr/libexec/openssh

Changed:/usr/libexec/gnome-screensaver

Changed:/usr/libexec/awk

Changed:/usr/libexec/gcc/x86_64-redhat-linux/4.4.4

Changed:/usr/libexec/gnome-applets

Changed:/usr/libexec/gstreamer-0.10

Changed:/usr/libexec/file-roller

Changed:/usr/libexec/polkit-1

Changed:/usr/libexec/utempter

Changed:/usr/libexec/pulse

Changed:/usr/libexec/getconf

Changed:/USR/LIBEXEC/WEBKITGTK

Changed:/usr/lib/cups/driver

Changed:/usr/lib/cups/filter

Changed:/usr/lib64

Changed:/usr/lib64/nspluginwrapper

Changed:/USR/LIB64/VTE

Changed:/usr/lib64/firefox

Changed:/usr/lib64/seahorse

Changed:/usr/lib64/pm-utils/bin

Changed:/usr/lib64/udev

Changed:/usr/lib64/gnome-session/helpers

Changed:/usr/lib64/nss/unsupported-tools

Changed:/usr/lib64/libv4l

Changed:/usr/lib64/libgphoto2

Changed:/USR/LIB64/FESTIVAL/ETC

Changed:/usr/lib64/perl5/core

Changed:/usr/lib64/sa

Changed:/usr/lib64/xulrunner

Changed:/usr/lib64/gthumb

Changed:/usr/lib64/hal/scripts

Changed:/usr/bin

Changed:/lib/udev

Changed:/lib64

Changed:/lib64/dbus-1

Changed:/bin

Changed:/sbin

--------------------------------------------------

Detailed information about changes:

---------------------------------------------------

Directory:/usr/sbin

Mtime:2016-03-22 02:44:18, 2016-03-22 02:57:45

Ctime:2016-03-22 02:44:18, 2016-03-22 02:57:45

Directory:/usr/libexec

Mtime:2016-03-22 02:44:34, 2016-03-22 02:58:06

Ctime:2016-03-22 02:44:34, 2016-03-22 02:58:06

Directory:/usr/libexec/openssh

Mtime:2016-03-22 02:44:35, 2016-03-22 02:58:06

Ctime:2016-03-22 02:44:35, 2016-03-22 02:58:06

Directory:/usr/libexec/gnome-screensaver

Mtime:2016-03-22 02:44:35, 2016-03-22 02:58:07

Ctime:2016-03-22 02:44:35, 2016-03-22 02:58:07

Directory:/usr/libexec/awk

Mtime:2016-03-22 02:44:35, 2016-03-22 02:58:07

Ctime:2016-03-22 02:44:35, 2016-03-22 02:58:07

Directory:/usr/libexec/gcc/x86_64-redhat-linux/4.4.4

Mtime:2016-03-22 02:44:36, 2016-03-22 02:58:08