Local Aide Checks - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

This will create a new database at the location specified as database_out in the
configuration file. By default, this is /var/lib/aide/aide.db.new. If you want
to check if all of your configuration worked as expected, you can open this database
file in a text viewer. Each of the checked files should appear at the beginning of a line
in this file.
Finally, copy the generated database to a save location like a CD-R, a remote Server
or an USB disk for later use.

13.2 Local AIDE Checks

Before you can run AIDE checks on your system, the first thing you have to do is to
rename the database. By default, this is done with the command:
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
After any configuration change, you always have to reinitialize the AIDE database and
subsequently move the newly generated database. It is also a good idea to make a
backup of this database.
The actual check if there were changes to the system is simple. Just run the command
aide --check. If the output is empty, everything is fine. If AIDE found changes,
you will be displayed a summary of changes like the following:
aide --check
AIDE found differences between database and filesystem!!
Summary:
Total number of files:
Added files:
Removed files:
Changed files:
To learn about the actual changes, increase the verbose level of the check with the pa-
rameter -V. For the previous example, this could look like the following:
118 Security Guide
1992
0
0
1