Description

Installs and configures the AIDE host-based intrusion detection system.

Requirements

Platform

Tested on CentOS and Ubuntu

Attributes

• node["aide"]["binary"] - Path to aide binary. Defaults to a sensible
  choice for the platform

• node["aide"]["config"] - Path to aide.conf file. Defaults to a sensible
  choice for the platform

• node["aide"]["extra_parameters"] - Extra parameters to use when invoking
  aide. Defaults to a sensible choice for the platform.

• node["aide"]["cron_service"] - The name of the cron service on the
  platform. Defaults to a sensible choice for the platform.

• node["aide"]["dbdir"] - Where the AIDE database files are kept. Defaults
  to /var/lib/aide

• node["aide"]["macros"] - A dictionary of AIDE macros, pre-populated
  as in the default AIDE config file.

• node["aide"]["paths"] - A dictionary of paths for AIDE to inspect and
  how to handle them, pre-populated as in the default AIDE config file.

• node["aide"]["report_url"] - Where to send the output. Defaults to "stdout".
  See the AIDE documentation for other options.

• node["aide"]["cron_mailto"] - Where to send the cron jobs' output. Either a
  string or the value nil. Defaults to nil (i.e. mail cron job output to the
  user the cron job runs as).

Usage

Typically, you'll want to add the default recipe to a role's run list, then
add to the paths dictionary with locations to ignore. Remember that paths
use regex syntax, not glob syntax, so "all files in /opt/foo" is expressed
as "/opt/foo/.*" not "/opt/foo/*".

{
  "name": "foo",
  ...
  "run_list": [
    ...
    "recipe[aide]"
  ],
  "override_attributes": {
    ...
    "aide": {
      "paths": {
        "/opt/foo/.*": "!"
      }
    }
  }
}

License and Author

Author:: Elliot Kendall (elliot.kendall@ucsf.edu)
Contributor:: Michael Burns (michael@mirwin.net)

Copyright:: 2013, The Regents of the University of California