From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id B594815808B for ; Sat, 12 Mar 2022 00:12:34 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D3A01E0893; Sat, 12 Mar 2022 00:12:33 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 798B4E0893 for ; Sat, 12 Mar 2022 00:12:33 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 4B24D343020 for ; Sat, 12 Mar 2022 00:12:32 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 9544A2B0 for ; Sat, 12 Mar 2022 00:12:30 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1647043899.a1c2babb3bb0ba114b392617cdafd27b3a68e67b.sam@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-forensics/aide/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-forensics/aide/files/aide.cron-r2 X-VCS-Directories: app-forensics/aide/files/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: a1c2babb3bb0ba114b392617cdafd27b3a68e67b X-VCS-Branch: master Date: Sat, 12 Mar 2022 00:12:30 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: e1bb1b17-c67c-432a-b4c8-82734df83dc8 X-Archives-Hash: 3af848e1d8316d300b2847fe65bb9009 commit: a1c2babb3bb0ba114b392617cdafd27b3a68e67b Author: Daniel Hiepler coderdu de> AuthorDate: Fri Mar 11 14:51:42 2022 +0000 Commit: Sam James gentoo org> CommitDate: Sat Mar 12 00:11:39 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a1c2babb app-forensics/aide: create new revision of aide.cron * replace tempfile with mktemp (respects $TMPDIR or uses /tmp by default) * Double quote to prevent globbing and word splitting. * Use $(...) notation instead of legacy backticks `...` * Prefer [ p ] && [ q ] as [ p -a q ] is not well defined * don't check $QUIETREPORTS twice * (--verbose): option no longer supported, use 'log_level' and 'report_level' options instead * remove old comment - remaining debianutils dependency (tempfile) is removed now * remove whitespace Signed-off-by: Daniel Hiepler coderdu.de> Signed-off-by: Sam James gentoo.org> app-forensics/aide/files/aide.cron-r2 | 188 ++++++++++++++++++++++++++++++++++ 1 file changed, 188 insertions(+) diff --git a/app-forensics/aide/files/aide.cron-r2 b/app-forensics/aide/files/aide.cron-r2 new file mode 100644 index 000000000000..b8a78ba2a856 --- /dev/null +++ b/app-forensics/aide/files/aide.cron-r2 @@ -0,0 +1,188 @@ +#!/bin/bash +# Modified: Benjamin Smee +# Date: Fri Sep 10 11:35:41 BST 2004 + +# This is the email address reports get mailed to +MAILTO=root@localhost + +# Set this to suppress mailings when there's nothing to report +QUIETREPORTS=1 + +# This parameter defines which aide command to run from the cron script. +# Sensible values are "update" and "check". +# Default is "check", ensuring backwards compatibility. +# Since "update" does not take any longer, it is recommended to use "update", +# so that a new database is created every day. The new database needs to be +# manually copied over the current one, though. +COMMAND=update + +# This parameter defines how many lines to return per e-mail. Output longer +# than this value will be truncated in the e-mail sent out. +LINES=1000 + +# This parameter gives a grep regular expression. If given, all output lines +# that _don't_ match the regexp are listed first in the script's output. This +# allows to easily remove noise from the aide report. +NOISE="(/var/cache/|/var/lib/|/var/tmp)" +PATH="/bin:/usr/bin:/sbin:/usr/sbin" +LOGDIR="/var/log/aide" +LOGFILE="aide.log" +CONFFILE="/etc/aide/aide.conf" +ERRORLOG="aide_error.log" +MAILLOG="aide_mail.log" +ERRORTMP=$(mktemp "${ERRORLOG}.XXXXXX") + +[ -f /usr/bin/aide ] || exit 0 + +DATABASE=$(grep "^database=file:/" $CONFFILE | head -n 1 | cut --delimiter=: --fields=2) +FQDN=$(hostname -f) +DATE=$(date +"at %Y-%m-%d %H:%M") + +# default values + +DATABASE="${DATABASE:-/var/lib/aide/aide.db}" + +AIDEARGS="" + +if [ ! -f "$DATABASE" ]; then + /usr/sbin/sendmail $MAILTO <"$LOGDIR/$LOGFILE" 2>"$ERRORTMP" +RETVAL=$? + +if [ -n "$QUIETREPORTS" ] && ! [ -s "$LOGDIR/$LOGFILE" ] && ! [ -s "$ERRORTMP" ] ; then + # Bail now because there was no output and QUIETREPORTS is set + exit 0 +fi + +MAILTMP=$(mktemp "${MAILLOG}.XXXXXX") + +(cat << EOF +This is an automated report generated by the Advanced Intrusion Detection +Environment on $FQDN ${DATE}. + +EOF + +# include error log in daily report e-mail + +if [ "$RETVAL" != "0" ]; then + cat > "$LOGDIR/$ERRORLOG" << EOF + +***************************************************************************** +* aide returned a non-zero exit value * +***************************************************************************** + +EOF + echo "exit value is: $RETVAL" >> "$LOGDIR/$ERRORLOG" +else + touch "$LOGDIR/$ERRORLOG" +fi +< "$ERRORTMP" cat >> "$LOGDIR/$ERRORLOG" +rm -f "$ERRORTMP" + +if [ -s "$LOGDIR/$ERRORLOG" ]; then + errorlines=$(wc -l "$LOGDIR/$ERRORLOG" | awk '{ print $1 }') + if [ "${errorlines:=0}" -gt $LINES ]; then + cat << EOF + +**************************************************************************** +* aide has returned many errors. * +* the error log output has been truncated in this mail * +**************************************************************************** + +EOF + echo "Error output is $errorlines lines, truncated to $LINES." + head -$LINES "$LOGDIR/$ERRORLOG" + echo "The full output can be found in $LOGDIR/$ERRORLOG." + else + echo "Errors produced ($errorlines lines):" + cat "$LOGDIR/$ERRORLOG" + fi +else + echo "AIDE produced no errors." +fi + +# include de-noised log + +if [ -n "$NOISE" ]; then + NOISETMP=$(mktemp "aidenoise.XXXXXX") + NOISETMP2=$(mktemp "aidenoise.XXXXXX") + sed -n '1,/^Detailed information about changes:/p' "$LOGDIR/$LOGFILE" | \ + grep '^\(changed\|removed\|added\):' | \ + grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" > "$NOISETMP2" + + if [ -n "$NOISE" ]; then + < "$NOISETMP2" grep -v "^\(changed\|removed\|added\):$NOISE" > "$NOISETMP" + rm -f "$NOISETMP2" + echo "De-Noised output removes everything matching $NOISE." + else + mv "$NOISETMP2" "$NOISETMP" + echo "No noise expression was given." + fi + + if [ -s "$NOISETMP" ]; then + loglines=$(< "$NOISETMP" wc -l | awk '{ print $1 }') + if [ "${loglines:=0}" -gt $LINES ]; then + cat << EOF + +**************************************************************************** +* aide has returned long output which has been truncated in this mail * +**************************************************************************** + +EOF + echo "De-Noised output is $loglines lines, truncated to $LINES." + < "$NOISETMP" head -$LINES + echo "The full output can be found in $LOGDIR/$LOGFILE." + else + echo "De-Noised output of the daily AIDE run ($loglines lines):" + cat "$NOISETMP" + fi + else + echo "AIDE detected no changes after removing noise." + fi + rm -f "$NOISETMP" + echo "============================================================================" +fi + +# include non-de-noised log + +if [ -s "$LOGDIR/$LOGFILE" ]; then + loglines=$(wc -l "$LOGDIR/$LOGFILE" | awk '{ print $1 }') + if [ "${loglines:=0}" -gt $LINES ]; then + cat << EOF + +**************************************************************************** +* aide has returned long output which has been truncated in this mail * +**************************************************************************** + +EOF + echo "Output is $loglines lines, truncated to $LINES." + head -$LINES "$LOGDIR/$LOGFILE" + echo "The full output can be found in $LOGDIR/$LOGFILE." + else + echo "Output of the daily AIDE run ($loglines lines):" + cat "$LOGDIR/$LOGFILE" + fi +else + echo "AIDE detected no changes." +fi +) > "${MAILTMP}" + +( +cat <