Where is the included folder rule in the new version of AIDE

Question

Previously I use AIDE on CentOS 7, and it was easy to include and exclude AIDE folder from scanning

There was already predefined rules that it can include or exclude folder like below:

# Exclude subfolder
!/usr/src/

# Include this folder with rule defined in CONTENT_EX
/usr/    CONTENT_EX

but, with the new version of AIDE starting Debian 10, I don't seems to understand how this folder is included or excluded. But I just found out that they have this bunch of predefined rules in here: /etc/aide/aide.conf.d. How does this new AIDE know which folder to include and what rule to use when it is scanning for file or folder changes?

Another question is: What is the best practice way to write the new excluded or included folder? Should we put new rule in /etc/aide/aide.conf.d ? Found the hidden doc here https://aide.github.io/doc/ but it does not mention anything about this.

I said hidden because this documentation is not published in the frontpage of aide.github.io but you need to type the sub url like this to get into that /doc/

Answer 1

If you look at /etc/aide/aide.conf, you will find this line at the bottom:

@@x_include /etc/aide/aide.conf.d ^[a-zA-Z0-9_-]+$

That line will include all scanning rules from /etc/aide/aide.conf.d/*

In AIDE there must be at least 1 include rule for the scan to work. So, inside /etc/aide/aide.conf.d/ folder this is one of the example of rules that actually include the scanning folders:

99_aide_root

The above file has the following content:

# this is the catch-all rule that includes everything that is not restricted by earlier rules
# this rule is deliberately unrestricted
/ Full

The meaing of / is to include the root directory in scanning and the second argument Full means to use the rule that define as Full from /etc/aide/aide.conf.

So, basically aide has included everything in scanning using the rule above. So you don't have to care about the include rule. What you should care is the exclude rule to ignore some folders or files. So, to exclude some folders or files you can create a file in /etc/aide/aide.conf.d/myrule

Inside myrule, you can put this:

# Exclude subfolder
!/usr/src/

and finally that folder will not be included in scan