In this article, we set up AFICK. Let’s adapt AFICK to use a particular directory tree and a different database. This way, we can fingerprint the OS on one run, and fingerprint more dynamic content with a different job. Here is our configuration file:
[root@ids afick]# cat /etc/afickweb.conf database:=/var/lib/afickweb/afick history := /var/lib/afickweb/history archive := /var/lib/afickweb/archive report_url := stdout verbose := no debug := 0 warn_dead_symlinks := no follow_symlinks := no allow_overload := no report_full_newdel := yes warn_missing_file := yes running_files := yes timing := yes ignore_case := no max_checksum_size := 10000000 checkrule = p+d+i+n+u+g+s+b+md5+m /directorytocheck checkrule [root@ids afick]# |
To initialize the database at the new location, we need to use the -c option to specify the different configuration file, and -i to initialize the database at the new location:
[root@ids afick]# afick -c /etc/afickweb.conf -i # Afick (2.8-2) init at 2005/08/30 07:21:45 with options (/etc/afickweb.conf): # database:=/var/lib/afickweb/afick # history:=/var/lib/afickweb/history # archive:=/var/lib/afickweb/archive # report_url:=stdout # report_full_newdel:=1 # warn_missing_file:=1 # running_files:=1 # timing:=1 # max_checksum_size:=10000000 # Hash database created successfully. 12032 files entered. # ################################################################# # MD5 hash of /var/lib/afickweb/afick => somemd5hash # user time : 19.05; system time : 5.43; real time : 60 [root@ids afick]# |
Update the database:
[root@ids afick]# afick -c /etc/afickweb.conf -u # Afick (2.8-2) update at 2005/08/30 07:24:43 with options (/etc/afickweb.conf): # database:=/var/lib/afickweb/afick # history:=/var/lib/afickweb/history # archive:=/var/lib/afickweb/archive # report_url:=stdout # report_full_newdel:=1 # warn_missing_file:=1 # running_files:=1 # timing:=1 # max_checksum_size:=10000000 # last run on 2005/08/30 07:21:45 with afick version 2.8-2 new file : /var/lib/afickweb/afick.ctr new file : /var/lib/afickweb/afick.dir new file : /var/lib/afickweb/afick.pag changed file : /directorytocheck/picture.jpg changed file : /directorytocheck/picture9.jpg # detailed changes new file : /var/lib/afickweb/afick.ctr inode_date : Tue Aug 30 07:22:45 2005 new file : /var/lib/afickweb/afick.dir inode_date : Tue Aug 30 07:24:43 2005 new file : /var/lib/afickweb/afick.pag inode_date : Tue Aug 30 07:25:39 2005 changed file : /directorytocheck/picture.jpg md5 : somemd5hash somemd5hash filesize : 2772 2756 mtime : Tue Aug 30 07:18:37 2005 Tue Aug 30 07:23:41 2005 changed file : /directorytocheck/picture9.jpg md5 : somemd5hash somemd5hash filesize : 2753 2756 mtime : Tue Aug 30 06:33:06 2005 Tue Aug 30 07:23:42 2005 # Hash database updated successfully : 12035 files scanned, 5 changed (new : 3; delete : 0; changed : 2; dangling : 0; exclude_suffix : 0; exclude_prefix : 0; exclude_re : 0; degraded : 2) # ################################################################# # MD5 hash of /var/lib/afickweb/afick => somemd5hash # user time : 21.03; system time : 4.91; real time : 56 [root@ids afick]# |
Let’s check in the new location:
[root@ids afick]# afick -c /etc/afickweb.conf -k # Afick (2.8-2) compare at 2005/08/30 07:26:15 with options (/etc/afickweb.conf): # database:=/var/lib/afickweb/afick # history:=/var/lib/afickweb/history # archive:=/var/lib/afickweb/archive # report_url:=stdout # report_full_newdel:=1 # warn_missing_file:=1 # running_files:=1 # timing:=1 # max_checksum_size:=10000000 # last run on 2005/08/30 07:24:43 with afick version 2.8-2 # Hash database : 12035 files scanned, 0 changed (new : 0; delete : 0; changed : 0; dangling : 0; exclude_suffix : 0; exclude_prefix : 0; exclude_re : 0; degraded : 2) # ################################################################# # MD5 hash of /var/lib/afickweb/afick => somemd5hash # user time : 21.28; system time : 4.65; real time : 58 [root@ids afick]# |
Now, what we want to do is move the AFICK database to a non-root home directory. The intention is that individual users can run integrity checks on their own files. We need to move the database from /var/lib to /home/limited:
[root@ids lib]# mv afickweb /home/limited [root@ids lib]# cd /home/limited [root@ids limited]# ls -l drwxr-xr-x 3 root root 4096 Aug 30 07:22 afickweb |
Change the permisssions:
[root@ids limited]# chown limited afickweb -R [root@ids limited]# chmod 700 afickweb -R [root@ids limited]# ls -l afickweb total 3048 -rwx------ 1 limited root 471 Aug 30 07:32 afick.ctr -rwx------ 1 limited root 4096 Aug 30 07:22 afick.dir -rwx------ 1 limited root 8370176 Aug 30 07:32 afick.pag drwx------ 2 limited root 4096 Aug 30 07:34 archive -rwx------ 1 limited root 1138 Aug 30 07:35 history |
The configuration file needs to be changed for the new location and moved:
[root@ids limited]# vi /etc/afickweb.conf [root@ids limited]# mv /etc/afickweb.conf /home/limited/ [root@ids limited]# chmod 700 /home/limited/afickweb.conf [root@ids limited]# chown limited /home/limited/afickweb.conf [root@ids limited]# ls -l /home/limited/afickweb.conf -rwx------ 1 limited root 425 Aug 30 07:37 /home/limited/afickweb.conf [root@ids limited]# |
Update the database:
ids limited $ afick -c ~/afickweb.conf -u WARNING: (control) directives change : database:=/var/lib/afickweb/afick / database:=/home/limited/afickweb/afick WARNING: (control) directives change : history:=/var/lib/afickweb/history / history:=/home/limited/afickweb/history WARNING: (control) directives change : archive:=/var/lib/afickweb/archive / archive:=/home/limited/afickweb/archive WARNING: (control) directives change : report_url:=STDOUT / report_url:=stdout # Afick (2.8-2) update at 2005/08/30 07:41:02 with options (/home/limited/afickweb.conf): # database:=/home/limited/afickweb/afick # history:=/home/limited/afickweb/history # archive:=/home/limited/afickweb/archive # report_url:=stdout # report_full_newdel:=1 # warn_missing_file:=1 # running_files:=1 # timing:=1 # max_checksum_size:=10000000 # last run on 2005/08/30 07:31:48 with afick version 2.8-2 new file : /home/limited/afickweb.conf new file : /home/limited/afickweb/afick.ctr new file : /home/limited/afickweb/afick.dir new file : /home/limited/afickweb/afick.pag deleted file : /etc/afickweb.conf deleted file : /var/lib/afickweb/afick.ctr deleted file : /var/lib/afickweb/afick.dir deleted file : /var/lib/afickweb/afick.pag changed file : /directorytocheck/picture.jpg changed file : /directorytocheck/picture1.jpg changed file : /directorytocheck/picture2.jpg # detailed changes new file : /home/limited/afickweb.conf inode_date : Tue Aug 30 07:38:38 2005 new file : /home/limited/afickweb/afick.ctr inode_date : Tue Aug 30 07:36:51 2005 new file : /home/limited/afickweb/afick.dir inode_date : Tue Aug 30 07:41:02 2005 new file : /home/limited/afickweb/afick.pag inode_date : Tue Aug 30 07:41:58 2005 deleted file : /etc/afickweb.conf parent_date : Tue Aug 30 07:38:09 2005 deleted file : /var/lib/afickweb/afick.ctr parent_date : Wed Dec 31 18:00:00 1969 deleted file : /var/lib/afickweb/afick.dir parent_date : Wed Dec 31 18:00:00 1969 deleted file : /var/lib/afickweb/afick.pag parent_date : Wed Dec 31 18:00:00 1969 changed file : /directorytocheck/picture.jpg md5 : somemd5hash somemd5hash filesize : 2747 2754 mtime : Tue Aug 30 07:28:44 2005 Tue Aug 30 07:38:52 2005 changed file : /directorytocheck/picture1.jpg md5 : somemd5hash somemd5hash filesize : 2761 2758 mtime : Tue Aug 30 06:43:14 2005 Tue Aug 30 07:33:50 2005 changed file : /directorytocheck/picture2.jpg md5 : somemd5hash somemd5hash filesize : 2773 2754 mtime : Tue Aug 30 06:48:17 2005 Tue Aug 30 07:38:54 2005 # Hash database updated successfully : 12035 files scanned, 11 changed (new : 4; delete : 4; changed : 3; dangling : 0; exclude_suffix : 0; exclude_prefix : 0; exclude_re : 0; degraded : 2) # ################################################################# # MD5 hash of /home/limited/afickweb/afick => somemd5hash # user time : 21.15; system time : 4.98; real time : 57 ids limited $ |
Note that if you rsync the filesystem offsite, you can use the above configuration to check the root filesystem in a secure way, since nobody can mess with your check database.
