[置顶] RH413企业安全加固 第8章 监视文件系统变更
第8章 监视文件系统变更(注意:红字)
环境配置
1、RHEL6.4 SERVER IP:10.10.10.221
2、RHEL6.4 CLIENT IP:10.10.10.223
1、aide工具主要做入侵检测，先创建原数据库跟更改的系统的文件进行比对来检测文件系统发生的变化。
2、RHEL6.4 CLIENT安装aide包
[root@student ~]# yum install -y aide
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package aide.x86_64 0:0.14-3.el6_2.2 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================================================================================================
Package Arch Version Repository Size
=============================================================================================================================================================
Installing:
aide x86_64 0.14-3.el6_2.2 aa 123 k
Transaction Summary
=============================================================================================================================================================
Install 1 Package(s)
Total download size: 123 k
Installed size: 297 k
Downloading Packages:
aide-0.14-3.el6_2.2.x86_64.rpm | 123 kB 00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : aide-0.14-3.el6_2.2.x86_64 1/1
aa/productid | 1.7 kB 00:00
Verifying : aide-0.14-3.el6_2.2.x86_64 1/1
Installed:
aide.x86_64 0:0.14-3.el6_2.2
Complete!
3、配置/etc/aide.conf文件
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide
默认存放的数据库位置和日志存放位置
database=file:@@{DBDIR}/aide.db.gz
默认读取的数据为aide.db.gz
#p: permissions --权限
#i: inode: --节点
#n: number of links --链接数
#u: user --用户
#g: group --组
#s: size --大小
#b: block count --块数
#m: mtime --最后的更新时间
#a: atime --最后的访问时间
#c: ctime --最后的创建时间
#S: check for growing size
#acl: Access Control Lists
#selinux SELinux security context
#xattrs: Extended file attributes
#md5: md5 checksum
#R: p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
#L: p+i+n+u+g+acl+selinux+xattrs
#E: Empty group
#>: Growing logfile p+u+g+i+n+S+acl+selinux+xattrs
# Next decide what directories/files you want in the database.
默认监控的目录
/boot NORMAL
/bin NORMAL
/sbin NORMAL
/lib NORMAL
/lib64 NORMAL
/opt NORMAL
/usr NORMAL
/root NORMAL
# These are too volatile
!/usr/src
!/usr/tmp
NORMAL = R+rmd160+sha256 --这是NORMAL方式
4、做文件特殊监控
1)在/etc/aide.conf配置文件最后一行添加一行，/etc/important NORMAL
将从默认监控的目录开始到做后都注释掉只留/etc/important NORMAL
这行，如何注释掉请使用ctrl+v接着将把要注释的行选上，接着按大
写“I”，接着按“#”，最后按ESC键2次。
2) 创建/etc/important文件
[root@student ~]# cat /etc/important
Strom
5、生成初始化数据库
[root@student ~]# aide --init
AIDE, version 0.14
### AIDE database at /var/lib/aide/aide.db.new.gz initialized.
6、重命名初始化数据库防止新的数据覆盖
[root@student ~]# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
7、执行系统检测
[root@student ~]# aide --check
AIDE, version 0.14
### All files match AIDE database. Looks okay!
8、改变要检测的系统文件
[root@student ~]# echo strom_wind >> /etc/important
9、再次检测系统文件是否被改动过
[root@student ~]# aide --check
AIDE found differences between database and filesystem!!
Start timestamp: 2016-01-19 08:08:42
Summary:
Total number of files: 3
Added files: 0
Removed files: 0
Changed files: 1
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /etc/important
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
File: /etc/important
Size : 7 , 18
Mtime : 2016-01-19 08:00:39 , 2016-01-19 08:07:59
Ctime : 2016-01-19 08:00:39 , 2016-01-19 08:07:59
MD5 : cp7rxRDI/M88Fhn6Zt9VGA== , wOlYQsO1nhVadqOcwNaQHg==
RMD160 : rJL55/zDPiUsXEvUO/puUU/4oEQ= , 9F6F/8ju5w585NLfY49P2OFRFqo=
SHA256 : n0WcSvFX9Rey7SWtwQC990oOUnpVxroH , dDZRM9+HBzEk6yCtPIm2NjXnLuTmcK+w