[Aide] Renaming aide.db.new cause false positives

[Nikhil Sole]

Hi,
I'm new to aide and this list.
I'm setting up aide on a SuSE box and so far things look great.

I tweaked the default /etc/aide.conf file to add my specific needs but left the config parameters as is, esp.:
database=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new

My concern is, after init, I have to move aide.db.new to aide.db
However, every subsequent check then tells me "aide.db.new" is removed and "aide.db" is added.
Thats the only change and but it raises false positives.

Is it recommended to ignore these two files from the checks? Or should the database_out be changed to "aide.db"? Or am I missing something basic here?

I sounds like a pretty generic issues but I couldnt find any mention on this or other mailing lists.

Thank you!

[Nikhil Sole]

Thanks Marc,
I had ended up ignoring these two files:!/var/lib/aide/aide.db!/var/lib/aide/aide.db.new
But I think your suggestion of adding custom rules for these two files seems like a better approach.
Thanks,Nikhil
> Date: Sat, 9 May 2015 14:24:06 +0200
> From: mh+***@zugschlus.de
> To: ***@cs.tut.fi
> Subject: Re: [Aide] Renaming aide.db.new cause false positives
>
> On Wed, May 06, 2015 at 01:25:42PM -0400, Nikhil Sole wrote:
> > I tweaked the default /etc/aide.conf file to add my specific needs but left the config parameters as is, esp.:
> > database=file:/var/lib/aide/aide.db
> > database_out=file:/var/lib/aide/aide.db.new
>
> I generally only copy over aide.db.new to aide.db. And I have
> OwnerMode = p+u+g+ftype
> VarFile = OwnerMode+n+l+X
> /var/lib/aide/aide\.db(\.new)?$ VarFile
>
> Greetings
> Marc
>
> --
> -----------------------------------------------------------------------------
> Marc Haber | "I don't trust Computers. They | Mailadresse im Header
> Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
> Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
> _______________________________________________
> Aide mailing list
> ***@cs.tut.fi
> https://mailman.cs.tut.fi/mailman/listinfo/aide

[Keith Constable]

On Saturday, May 9, 2015, Nikhil Sole <***@hotmail.com> wrote:

> Thanks Marc,
>
> I had ended up ignoring these two files:
> !/var/lib/aide/aide.db
> !/var/lib/aide/aide.db.new
>
> But I think your suggestion of adding custom rules for these two files
> seems like a better approach.
>
> Thanks,
> Nikhil
>

Nikhil,

Bear in mind that those rules negate AIDE's ability to detect changes that
an intruder might make. All the intruder has to do is generate a new
aide.db to cover his tracks.

On the other hand, if your only concern is data integrity, without
intrusion detection, then carry on.

Regards,

Keith Constable