Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to use AIDE to help me verify the integrity of my home directory on a shared Linux system. I am not an administrator of this system. I have built and installed AIDE in my home directory and it seems to work properly.

The sysadmin has set permissions on /home to 0751. This allows users to enter /home, but not list the contents of the directory (an ineffective security measure, in my opinion).

For demonstration purposes, consider this overly simple aide.conf:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
/home/kccricket R

Given this setup, running aide -i will output:

open_dir():Permission denied: /home

AIDE, version 0.15.1

### AIDE database at aide.db.new initialized.

The resulting AIDE database will be empty. If I run the same command with -V255 (highest verbosity), I can see that AIDE examines every directory in / and then attempts to do the same with /home. It chokes because it can't list the contents of /home.

Is there a way to make this work, short of asking the sysadmin to change the perms on /home?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

The solution to this problem is to build AIDE from the current development snapshot or the 0.16a2 alpha release.

Version 0.16a2 includes a new option:

root_prefix
          The prefix to strip from each file name in the file system before applying
          the rules and writing to database. Aide removes a trailing slash from  the
          prefix.  The default is no (an empty) prefix. This option has no effect in
          compare mode.

In the case of this question, the new aide.conf file would be:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
root_prefix=/home/kccricket
/ R

Thanks to Hannes von Haugwitz (hannes@vonhaugwitz.com) of the AIDE team for this information.

share|improve this answer
add comment

You can have aide limit it's scan to only the folder specified by appending a =.

Example with your configuration:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
/home/kccricket R

Change the line /home/kccricket R to =/home/kccricket R

That will force aide to only scan inside the specified folder, and not take a peek outside causing a failure.

share|improve this answer
    
That's an excellent suggestion that I hadn't thought of. Unfortunately, it doesn't help –  kccricket Jul 5 '12 at 20:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.