[Gelöst] aide 0.17.3 findet keine Dateien/Rules

wakko

Member
Update: Gelöst. Ich musste nicht das Paket "aide" sondern "aide-common" neuinstallieren, damit die config zurückgesetzt wird. Damit läuft es wieder.
(In Zukunft werde ich noch eine Stunde länger warten bis ich hier um Hilfe frage... )
------------------------------------
Hallo,
ich habe gerade größtenteils erfolgreich einen VPS von Debian 10 auf Debian 11 hochgezogen. Alles Dienste laufen wieder, das einzige was ich nicht zum Laufen kriege ist aide. In der Version 0.17.3 scheint sich einiges an der Konfiguration geändert zu haben. Ich habe zuerst alle Fehler und deprecated Warnings in der aide.conf behoben, allerdings findet aide sowohl beim Update (alte /var/lib/aide.db noch vorhanden) als auch beim (dry-)init absolut keine Dateien.
Beim dry-init kriege ich diese Ausgabe, also scheinen da die Regeln nicht aktiviert zu sein:
Code:
    root@hostname:/etc/aide# aide -n -c /etc/aide/aide.conf

    [ ] d '/': no matching rule
    [ ] d '/proc': no matching rule
    [ ] d '/lib64': no matching rule
    [ ] d '/var': no matching rule
    [ ] d '/tmp': no matching rule
    [ ] f '/dovecot': no matching rule
    [ ] d '/opt': no matching rule
    [ ] l '/initrd.img.old': no matching rule
    [ ] d '/dev': no matching rule
    [ ] l '/vmlinuz': no matching rule
    [ ] d '/home': no matching rule
    [ ] l '/initrd.img': no matching rule
    [ ] d '/mnt': no matching rule
    [ ] f '/vmd22486': no matching rule
    [ ] d '/root': no matching rule
    [ ] d '/boot': no matching rule
    [ ] d '/srv': no matching rule
    [ ] d '/etc': no matching rule
    [ ] d '/sbin': no matching rule
    [ ] d '/usr': no matching rule
    [ ] d '/run': no matching rule
    [ ] d '/lost+found': no matching rule
    [ ] d '/lib': no matching rule
    [ ] d '/bin': no matching rule
    [ ] d '/media': no matching rule
    [ ] d '/sys': no matching rule
    [ ] l '/vmlinuz.old': no matching rule

Wo aktiviere ich diese Regeln? Bisher hat aide sauber funktioniert, inkl. diverser custom excludes in /etc/aide/aide.conf.d/.
Auch ein reinstall von aide per apt hat nichts gebracht, um die aide.conf auf Auslieferungszustand zu setzen.

Code:
root@hostname:/etc/aide# cat aide.conf
# AIDE conf

# The daily cron job depends on these paths
database_in=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new
database_new=file:/var/lib/aide/aide.db.new
gzip_dbout=yes

# Set to no to disable summarize_changes option.
report_summarize_changes=true

# Set to no to disable grouping of files in report.
report_grouped=true

# standard verbose level
# commented out because deprecated in favor of log_level
#verbose = 5

# Set to yes to print the checksums in the report in hex format
report_base16 = no

# if you want to sacrifice security for speed, remove some of these
# checksums. Whirlpool is broken on sparc and sparc64 (see #429180,
# #420547, #152203).
#Checksums = sha256+sha512+rmd160+haval+gost+crc32+tiger
Checksums = sha256+rmd160+crc32

# The checksums of the databases to be printed in the report
# Set to 'E' to disable.
database_attrs = Checksums

# check permissions, owner, group and file type
OwnerMode = p+u+g+ftype

# Check size and block count
Size = s+b

# Files that stay static
InodeData = OwnerMode+n+i+Size+l+X
StaticFile = m+c+Checksums

# Files that stay static but are copied to a ram disk on startup
# (causing different inode)
RamdiskData = InodeData-i

# Check everything
Full = InodeData+StaticFile

# Files that change their mtimes or ctimes but not their contents
VarTime = InodeData+Checksums

# Files that are recreated regularly but do not change their contents
VarInode = VarTime-i

# Files that change their contents during system operation
VarFile = OwnerMode+n+l+X

# Directories that change their contents during system operation
VarDir = OwnerMode+n+i+X

# Directories that are recreated regularly and change their contents
VarDirInode = OwnerMode+n+X

# Directories that change their mtimes or ctimes but not their contents
VarDirTime = InodeData

# Logs grow in size. Log rotation of these logs will be reported, so
# this should only be used for logs that are not rotated daily.
Log = OwnerMode+n+S+X

# Logs that are frequently rotated
FreqRotLog = Log-S

# The first instance of a rotated log: After the log has stopped being
# written to, but before rotation
LowLog = Log-S

# Rotated logs change their file name but retain all their other properties
SerMemberLog  = Full+I

# The first instance of a compressed, rotated log: After a LowLog was
# compressed.
LoSerMemberLog = SerMemberLog+ANF

# The last instance of a compressed, rotated log: After this name, a log
# will be removed
HiSerMemberLog = SerMemberLog+ARF

# Not-yet-compressed log created by logrotate's dateext option:
# These files appear one rotation (renamed from the live log) and are gone
# the next rotation (being compressed)
LowDELog = SerMemberLog+ANF+ARF

# Compressed log created by logrotate's dateext option: These files appear
# once and are not touched any more.
SerMemberDELog = Full+ANF

# For daemons that log to a variable file name and have the live log
# hardlinked to a static file name
LinkedLog = Log-n
 
Last edited:
Back
Top