[HOME] [DOWNLOAD] [DOCS] [NEWS] [SUPPORT] [TIPS] [ISSUES] [DONATE]

rootkit detection system - AIDE

Should we have AIDE also preinstalled? ANy performance hits?

1 Like

As easy as installing by default and that’s it? How would users be notified?

I am open for the idea. -> Related: Installation of Antivirus Scanners by Default

1 Like

Running AIDE scans are a one liner once configured. Maybe it can be a whonixcheck subsystem?

1 Like

Could you test AIDE manually please?

What’s happening during upgrades? Does it detect false-positive backdoors then?

touch /root/aide-test/test1
aide -c /etc/aide/aide.conf --check
Added entries: 
 ---------------------------------------------------
 
 d++++++++++++++++: /root/aide-test
 
 f++++++++++++++++: /root/aide-test/test1

Even running sudo su once would update file /root/.bash_history and might be detected.

Output such as this could very quick look very scary when being unaware of AIDE.

Perhaps that is OK if properly worded. However, showing a ton of files modified after upgrade wouldn’t be helpful for anyone as nobody could tell which are malicious and which aren’t. I guess one would have to run AIDE before upgrading and after upgrading?

You can verify the newly created files from the above Aide check reports. It is recommended to update the aide database so that it’s not reported again on the next AIDE check.

^ Also usability issue.

Also you must keep the backup of the old Aide database and rename the updated database on daily basics to keep track.

Not sure realistic.

AIDE looks nice but I don’t know if we can configure it in a way to be mostly transparent for the user? Similar to LKRG which just does its thing without interference.

I tried installing its three main packages but they all fail with vague errors:

snip

Processing triggers for man-db (2.8.5-2) …
Errors were encountered while processing:
exim4-config
exim4-base
exim4-daemon-light
bsd-mailx
aide-common
E: Sub-process /usr/bin/dpkg returned an error code (1)
user@host:~$

This easily goes from one thing to another.

The aide package “doesn’t contain much”.

https://packages.debian.org/buster/amd64/aide/filelist

Configuration / integration is in aide-common package.

https://packages.debian.org/buster/all/aide-common/filelist

That package depends on bsd-mailx or mailx.

mailx Recommends: default-mta which is a virtual package provided by exim4-daemon-light or mail-transport-agent which is a virtual package provided by citadel-server, courier-mta, dma, esmtp-run, exim4-daemon-heavy, exim4-daemon-light, msmtp-mta, nullmailer, opensmtpd, postfix, qmail-run, sendmail-bin

MTA seems overkill. Not sure we want to introduce local command mail or some local command for it to show localhost e-mail? Try this:

sudo apt purge exim*

Then

sudo apt install aide-common --no-install-recommends

I cannot even reproduce maybe because something on my system already satisfies the dependency for default-mta.

Won’t cut it.

This works:

sudo apt install --no-install-recommends mailutils aide-common

Installation successful. But that leaves us with an unnecessary mailutils dependency.

Does that help?

1 Like

Yeah that fixed it :slight_smile:

1 Like

Installed configured scanned after a simple change like creating a hello file in home. Initial Scan takes 7 mins second scan 12 mins.

The logs are too detailed to be of use. Can easily alarm users with false positives. Maybe we can restrict scans to important system directories instead, but I have no idea if it will reduce security. Also sticking to one hashing algo instead of a bunch.

user@host:~$ sudo aide -c /etc/aide/aide.conf --check

Start timestamp: 2020-06-16 13:12:02 +0000 (AIDE 0.16.1)
AIDE found differences between database and filesystem!!
Verbose level: 6

Summary:
  Total number of entries:	108257
  Added entries:		3
  Removed entries:		0
  Changed entries:		8

---------------------------------------------------
Added entries:
---------------------------------------------------

f++++++++++++++++: /home/user/hello
f++++++++++++++++: /root/.bash_history
f++++++++++++++++: /var/lib/aide/aide.db

---------------------------------------------------
Changed entries:
---------------------------------------------------

f >b... mc..C.. .: /etc/aide/aide.conf
d =.... mc.. .. .: /home/user
f =.... mc..... .: /home/user/.config/Thunar/accels.scm
d =.... mc.. .. .: /home/user/.config/xfce4/panel
f =.... mci.... .: /home/user/.config/xfce4/panel/genmon-12.rc
f >.... mc..C.. .: /home/user/.xsession-errors
d =.... mc.. .. .: /root
f =.... mc..... .: /var/log/tallylog

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /etc/aide/aide.conf
  Size     : 6598                             | 41610
  Bcount   : 16                               | 88
  Mtime    : 2016-04-16 17:57:29 +0000        | 2020-06-16 13:11:23 +0000
  Ctime    : 2020-06-16 12:55:53 +0000        | 2020-06-16 13:11:23 +0000
  RMD160   : kHZi6LuS1X5nlHkrtCLV9UdgDxo=     | nWLCkh/27m8WdtqfvJN5txJk6N0=
  TIGER    : 4Xz+mZRAxr2kNIGOmTNJa/7Ftv+VpV37 | 03f2cg45KDTZEAcW1PjCoaFk3O1tsHTJ
  SHA256   : RN1UT38/wRA8N5o4M4MHU8N+G49sK9nB | HITtrsturCWRVZNwrqWy1hhgsvk/YsLv
             0B5VVewz3h8=                     | y9Rdn3bIZyg=
  SHA512   : o4LOstw3erheco5dpKcKLadGav29Ud9E | gKzPRfQxJop9wYn7iEU+xetq/4ijdq0A
             ZQd6cPiQZuQ7bsTZkx1MGEW+VYkhz5gj | A87ecmxcGyRQTXebk+aweXo86BkVB2Zx
             yKP7Fvoitf+jHcriq57Pgg==         | po+A2MXXcuzuXvbb2z0dTQ==
  CRC32    : S3Rhfg==                         | lTwfVw==
  HAVAL    : +O7017egNOm+/TJW/3HxeQcxmz55pDM7 | jWboJ2XDaiBYzQ9LV/lsc03lAyh8sNp8
             S+TXtMWVN/E=                     | 3gAVUOeXH3I=
  GOST     : 3NHf+nD39SudMxLJc5fkpkarUQ+unLQf | qO75hParpwqgXUNI2YarEwbcvM8AHO3Z
             NhV8dix9LIw=                     | dnXY4PCOHWE=

Directory: /home/user
  Mtime    : 2020-06-16 12:46:29 +0000        | 2020-06-16 13:11:51 +0000
  Ctime    : 2020-06-16 12:46:29 +0000        | 2020-06-16 13:11:51 +0000

File: /home/user/.config/Thunar/accels.scm
  Mtime    : 2020-06-15 19:38:23 +0000        | 2020-06-16 13:11:55 +0000
  Ctime    : 2020-06-15 19:38:23 +0000        | 2020-06-16 13:11:55 +0000

Directory: /home/user/.config/xfce4/panel
  Mtime    : 2020-06-16 12:54:21 +0000        | 2020-06-16 13:04:21 +0000
  Ctime    : 2020-06-16 12:54:21 +0000        | 2020-06-16 13:04:21 +0000

File: /home/user/.config/xfce4/panel/genmon-12.rc
  Mtime    : 2020-06-16 12:54:21 +0000        | 2020-06-16 13:04:21 +0000
  Ctime    : 2020-06-16 12:54:21 +0000        | 2020-06-16 13:04:21 +0000
  Inode    : 3277116                          | 3276910

File: /home/user/.xsession-errors
  Size     : 4192                             | 4792
  Mtime    : 2020-06-16 13:01:30 +0000        | 2020-06-16 13:11:44 +0000
  Ctime    : 2020-06-16 13:01:30 +0000        | 2020-06-16 13:11:44 +0000
  RMD160   : LP5njQR8Gu4yKORZ1BDm99jqNEQ=     | c1PehkzcV1hsyySBC8lCw2uQj/s=
  TIGER    : BISIzOV00RBOc5CBnoTzRa9j+Isit1GK | 3kHN25Y7QQBxX0VC7e79/0KoXSi4Cazo
  SHA256   : +D2LWACvl1ZIwWJdGffBh39T6f3mPp+d | AMc1N7UqWIfopIGTbS8bdknQAkBBftmQ
             5uKNNl1/ZVk=                     | ugg09xYIpFU=
  SHA512   : dcmKu991/Q+IFM92+wq2CXB3o37CUPdX | /FrXSNj63xw8mvu8k1AXUnZkel1JOAUo
             t5zrXSJgR15Qf0phwstj7vP6y3rcRSKt | 6lPjPFIddtVBuOAcDFHT24b9FrtpKNE4
             j37hA9da1/ir+99zNtAOyw==         | Wnp3HA/n8zK58rlo10wflA==
  CRC32    : BEcY2Q==                         | TTZJCg==
  HAVAL    : ims99jAishdeETO1iQxTDNfKTUwfP3rK | 3pVGGMMJEJV3zo02odIf8jO5qbbNKRhI
             QCLLadHFxRk=                     | vA2nm8lVlpA=
  GOST     : Ib6dU8ALacn+jYSAihJXgTRvz0RpcFKl | IsqK8KSZbFEJmosra7C/agc7JmxqEuaj
             vSc8/y9zi1w=                     | HsbM+plrogg=

Directory: /root
  Mtime    : 2020-06-15 19:38:26 +0000        | 2020-06-16 13:10:29 +0000
  Ctime    : 2020-06-15 19:38:26 +0000        | 2020-06-16 13:10:29 +0000

File: /var/log/tallylog
  Mtime    : 2020-06-16 12:54:58 +0000        | 2020-06-16 13:14:11 +0000
  Ctime    : 2020-06-16 12:54:58 +0000        | 2020-06-16 13:14:11 +0000


---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db
  RMD160   : gNa+l3rZdXjw7OCnBbszBqUAuNQ=
  TIGER    : 6cKfzEhkN4BZE8RuZLeTKoXrvI3I9In+
  SHA256   : uJb1CCJwRkgdz8wkuMcJ1NrX11y5Zuw5
             Mj6F8qm62Qc=
  SHA512   : WFFaJJO39+//fdNH3aFBnJ99cdJy58gS
             yp1ouCQe2XCUlElP3TXSHer6DKgTj0id
             /DItlBIXK+PCHQDrz6etJA==
  CRC32    : NOiIKg==
  HAVAL    : B9jZC16rRnIx46lJTqZr6Abhk8h9Ia6g
             J0/dG9tRC1g=
  GOST     : i5B1U+40LNPZjIjX6YsxKoxvkmRMrgM8
             fMs6QxXYV6k=


End timestamp: 2020-06-16 13:24:13 +0000 (run time: 12m 11s)
1 Like

Yes, AIDE needs configuration before it could be installed by default to be useful and not just produce unnecessary FUD.

I took a peak in /etc/aide/aide.conf.d/ and there are a lot of application specific exemptions to reduce false positives. /etc/aide.conf is where hashing algos are defined among other settings like verbosity levels. I am testing scan times with just SHA-256. Other algos are either slower or cryptographically broken,

1 Like

sha256

End timestamp: 2020-06-16 13:52:45 +0000 (run time: 7m 15s)

1 Like

Using dm-verity would be a much better alternative than AIDE.

1 Like

Yeah, but have any of the blockers for it been resolved?

2 Likes

Not really but I also haven’t been working on it as much since there’s tons of other work to do.

2 Likes
[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Investors] [Priority Support] [Professional Support]