How to install and secure egroupware - Directory UMM

6.1.6 Intrusion detection environment
Install an intrusion detection environment to keep check of your system files’ integrity and to detect changes
on your server.
There are several solutions available for *nix based systems:
AIDE
Tripwire
Samhain
Of the three above, AIDE is the easiest to set up.
6.1.6.1 Installing AIDE
Most distributions have AIDE included and you can install it with a standard tool like RPM or apt-get.
AIDE depends on the mhash package, which you must install as well. When no package is available for your
platform, you must compile it yourself with
. /configure
make
make install
6.1.6.2 The AIDE configuration file aide.conf
You must configure the aide.conf file so that all important files from your server are checked and to reduce
false alarms.
� Store /etc/aide.conf, /usr/sbin/aide and /var/lib/aide/aide.db.gz in a secure location, e.g. on
separate read-only media (such as CD-ROM). Alternatively, keep MD5 fingerprints or GPG signatures of
those files in a secure location, so you have a means to verify that nobody has modified these files.
# Example configuration file for AIDE.
@@define DBDIR /var/lib/aide
# The location of the database to be read.
database=file:/mnt/floppy/aide.db.gz
# The location of the database to be written.
database_out=file:@@{DBDIR}/aide.db.new.gz
# Whether to gzip the output to the database
gzip_dbout=yes
# Default.
Reiner Jung Install and Secure eGroupWare Page 28 of 67