aide

SELinux: AIDE Trying to Access SSSD Socket

by

I’m getting SELinux denials indicating that /usr/sbin/aide is trying to access a socket used by SSSD: the socket path is /var/lib/sss/pipes/nss. Here is the relevant text from sealert: Additional Information: Source Context system_u:system_r:aide_t:s0-s0:c0.c1023 Target Context system_u:object_r:sssd_var_lib_t:s0 Target Objects (null) [ sock_file ] Source aide Source Path /usr/sbin/aide Raw Audit Messages type=AVC msg=audit(1560503762.699:28324): avc: denied { … Read more

Interpreting flags in AIDE daily report

by

My questions is about the flags displayed by AIDE for each file in daily email reports. For example for new files its shows as follows: f++++++++++++++++: /var/cache/apt/archives/squashfs-tools_1%3a4.4-1ubuntu0.1_amd64.deb I can deduce that f stands for file and I have seen d which stands for directory. But what other flags can possibly come here? What about the … Read more

aide –init show lots of errors

by

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide –init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or leave it ? /usr/sbin/prelink: /usr/sbin/lusermod: at least one of file’s dependencies has changed … Read more

Auditing in linux

by

I am trying to setup a robust auditing mechanism on my centos 6.x boxes. I tried and tested various auditing tools like auditd aide psacct But none is full filling my requirement. My requirement is quite simple and I know one auditing system will not serve all and i may have to use different audit … Read more