AIDE setup problems.

[jimford]

I've installed AIDE on my 64 bit Xubuntu 12.10 laptop, but have some puzzling problems in setting it up.

I followed the configuration instructions in the las post in this thread: http://ubuntuforums.org/archive/inde...t-1096333.html

I ran:

sudo /usr/bin/aide.wrapper -c /etc/aide/aide.conf --init

Which created aide.db.old and aide.conf.autogenerated in /var/lib/aide/

I then ran:

sudo /usr/bin/aide.wrapper -c /etc/aide/aide.conf --check

This gave an error that it couldn't open aide.db (it hadn't been created in the 'init')

So I (reluctantly!) copied the aide.db.old to aide.db, and ran the 'check' again. This time the check showed the expected creation of the aide.db file, changes to the aide.conf.autogenerated file, and puzzlingly alteration of the aide.db.old file.

Next I ran:

sudo /usr/bin/aide.wrapper -c /etc/aide/aide.conf --compare

Which gave an error that the aide.db.new file couldn't be opened (there wasn't one)

By now alarm bells started to ring - having to do an initial manual copy of the db earlier and now having an error that there was no 'new' one created.

Is my installation correct and how does the aide.db.new get created, anyone please?

Jim

[unspawn]

Is my installation correct

Usually one would start by verifying the configuration file for errors

aide -c /etc/aide/aide.conf --config-check

followed by inspection

grep iv ^# /etc/aide/aide.conf|grep .

if any show up. 'man aide.conf' explains the database, database_out and database_new directives, 'man aide', the "--compare" switch, shows you how to use the database and database_new directives and running

grep database_ /etc/aide/aide.conf

shows you what you have configured right now. Your database_out doesn't match your database so each time you --init you have to rename it. Good practice but a bit tedious.

*FWIW (I don't know anything about your intended use or requirements) have a look at Samhain and compare features to see if what it offers over AIDE would suit you better (or not).