【aws】EC2でインスタンスにaide（改ざん検知）を導入

[root@ip-192-168-10-20 ec2-user]# ll /var/lib/aide/aide.db.new.gz
-rw——-. 1 root root 4184499 Jul 8 02:39 /var/lib/aide/aide.db.new.gz

[root@ip-192-168-10-20 ec2-user]# grep “database_in” /etc/aide.conf
database_in=file:@@{DBDIR}/aide.db.gz

cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

[root@ip-192-168-10-20 ec2-user]# ll /var/lib/aide/aide.db.gz
-rw——-. 1 root root 4184499 Jul 8 02:42 /var/lib/aide/aide.db.gz

[root@ip-192-168-10-20 ec2-user]# cat /var/log/aide/aide.log
Start timestamp: 2023-07-08 02:44:21 +0000 (AIDE 0.17.4)
AIDE found differences between database and filesystem!!

Summary:
Total number of entries: 45919
Added entries: 0
Removed entries: 0
Changed entries: 3

---

[root@ip-192-168-10-20 ec2-user]# cat /etc/cron.daily/aide_cron
# aideによる改ざん検知を毎日0時に実行するcronを設定
0 0 * * * root aide –check
[root@ip-192-168-10-20 ec2-user]#

[root@ip-192-168-10-20 ec2-user]# cat /etc/logrotate.d/aide
/var/log/aide/*.log {
weekly
missingok
rotate 4
compress
delaycompress
copytruncate
minsize 100k
}
[root@ip-192-168-10-20 ec2-user]#