--- doc/aide.conf.orig 1970-01-01 01:00:00.000000000 +0100 +++ doc/aide.conf 2008-02-27 15:29:48.000000000 +0100 @@ -0,0 +1,130 @@ +# AIDE conf + +database=file:%%PREFIX%%/var/lib/aide/aide.db +database_out=file:%%PREFIX%%/var/lib/aide/aide.db.new + +# Change this to "no" or remove it to not gzip output +# (only useful on systems with few CPU cycles to spare) +gzip_dbout=yes + +warn_dead_symlinks=no + +# Here are all the things we can check - these are the default rules +# +#p: permissions +#i: inode +#n: number of links +#u: user +#g: group +#s: size +#b: block count +#m: mtime +#a: atime +#c: ctime +#S: check for growing size +#md5: md5 checksum +#sha1: sha1 checksum +#rmd160: rmd160 checksum +#tiger: tiger checksum +#R: p+i+n+u+g+s+m+c+md5 +#L: p+i+n+u+g +#E: Empty group +#>: Growing logfile p+u+g+i+n+S +#haval: haval checksum +#gost: gost checksum +#crc32: crc32 checksum + +# This is the email address reports get mailed to +# It's only used by the cron script and at the moment only the first address +# specified in this manner will be used. +@@define MAILTO root +@@define LINES 1000 + +# Custom rules +Binlib = p+i+n+u+g+s+b+m+c+md5+sha1 +ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha1 +Logs = p+i+n+u+g+S +Devices = p+i+n+u+g+s+b+c+md5+sha1 +Databases = p+n+u+g +StaticDir = p+i+n+u+g +ManPages = p+i+n+u+g+s+b+m+c+md5+sha1 + +# Next decide what directories/files you want in the database + +# Kernel, system map, etc. +#=/boot$ Binlib +# Binaries +/bin Binlib +/sbin Binlib +/usr/bin Binlib +/usr/sbin Binlib +/usr/local/bin Binlib +/usr/local/sbin Binlib +#/usr/games Binlib +# Libraries +#/lib Binlib +/usr/lib Binlib +/usr/local/lib Binlib +# Log files +/var/log$ StaticDir +#/var/log/aide/aide.log(.[0-9])?(.gz)? Databases +#/var/log/aide/error.log(.[0-9])?(.gz)? Databases +#/var/log/setuid.changes(.[0-9])?(.gz)? Databases +#/var/log Logs +# Devices +!/dev/pts +/dev Devices +# Other miscellaneous files +/var/run$ StaticDir +#!/var/run +# Test only the directory when dealing with /proc +#/proc$ StaticDir +#!/proc + +# You can look through these examples to get further ideas + +# MD5 sum files - especially useful with debsums -g +#/var/lib/dpkg/info/([^\.]+).md5sums + +# Check crontabs +#/var/spool/anacron/cron.daily Databases +#/var/spool/anacron/cron.monthly Databases +#/var/spool/anacron/cron.weekly Databases +#/var/spool/cron Databases +#/var/spool/cron/crontabs Databases + +# manpages can be trojaned, especially depending on *roff implementation +#/usr/man ManPages +/usr/share/man ManPages +/usr/local/man ManPages + +# docs +#/usr/doc ManPages +#/usr/share/doc ManPages + +# check users' home directories +#/home Binlib + +# check sources for modifications +#/usr/src L +#/usr/local/src L + +# Check headers for same +#/usr/include L +#/usr/local/include L + +## MacOS X specific stuff +/Applications Binlib +/System Binlib +/Library Binlib +/Developer Binlib +/Volumes StaticDir +/Users StaticDir +/Trash StaticDir +## DP: %%PREFIX%% +%%PREFIX%%/bin Binlib +%%PREFIX%%/sbin Binlib +%%PREFIX%%/etc ConfFiles +%%PREFIX%%/lib Binlib +%%PREFIX%%/share/man ManPages +%%PREFIX%%/var/log Logs