In this lab, we will install the Advanced Intrusion Detection Environment (AIDE) and configure it to monitor directories and applications for changes. We will also set up a cron job to run a daily check using AIDE.
*This course is not approved or sponsored by Red Hat.*
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Install and configure AIDE
Install AIDE:
yum install -y aideInitialize AIDE:
/usr/sbin/aide --initCopy initialized database to production:
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
- Configure AIDE to run every day at 1 AM
Create a cronjob to run
aide --checkat 1 AM daily:nano /etc/crontab0 1 * * * /usr/sbin/aide --check
- Define directories and applications to monitor
Define directories to monitor:
nano /etc/aide.conf/patient-data DIR /accounting DIRAdd an application to monitor each time it’s accessed:
nano /etc/aide.confAPP_ACCESS = a /applications/payroll APP_ACCESS
- Update the AIDE database with new directory and application statuses
Update the AIDE database (because we made changes to the
/etc/aide.conffile):/usr/sbin/aide --updatecp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
