Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 168 / 450

To tell AIDE which attributes of which files should be checked, a configuration file
must be created. Find an example configuration at
/etc/aide.conf
. This file is
also a template and may be modified to create the actually used configuration. The first
section of the configuration handles general configuration parameters like the location
of the AIDE database file. More interesting for your local configurations are the
Custom
Rules
and the
Directories and Files
sections. A typical rule looks like the
following:
Binlib = p+i+n+u+g+s+b+m+c+md5+sha1
After defining the variable
Binlib
, the respective checking options are used in the
files section. Important options include the following:
Table 13.1 Important AIDE Checking Options
Description Option
Check for the file permissions of the selected files or directories. p
Check for the inode number. Every filename has a unique inode
number that should not change. i
Check for the number of links pointing to the respective file. n
Check if the owner of the file changed. u
Check if the group of the file changed. g
Check if the file size changed. s
Check if the block count used by the file changed. b
Check if the modification time of the file changed. m
Check if the files access time changed. c
Check if the md5 checksum of the file changed. md5
Check if the sha1 (160 Bit) checksum of the file changed. sha1
154 Security Guide