{"id":21771369,"url":"https://github.com/indiana-university/puppet-aide","last_synced_at":"2025-04-13T16:41:26.845Z","repository":{"id":34852515,"uuid":"183483743","full_name":"indiana-university/puppet-aide","owner":"indiana-university","description":"This puppet module manages the installation and configuration of AIDE (Advance Intrusion Detection Environment)","archived":false,"fork":false,"pushed_at":"2025-04-08T21:06:48.000Z","size":145,"stargazers_count":1,"open_issues_count":1,"forks_count":10,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-10T05:18:23.759Z","etag":null,"topics":["aide","audit","auditing","cis","cis-benchmarks","file-integrity","ids","intrusion-detection","puppet","puppet-module","security"],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/indiana-university.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-04-25T17:51:56.000Z","updated_at":"2025-04-08T20:49:59.000Z","dependencies_parsed_at":"2023-10-03T22:23:44.643Z","dependency_job_id":"d5e62a2a-3208-4289-adc6-7e3c2853f675","html_url":"https://github.com/indiana-university/puppet-aide","commit_stats":{"total_commits":65,"total_committers":8,"mean_commits":8.125,"dds":"0.24615384615384617","last_synced_commit":"553ef030cb1370e2fc7e506ea5b0ceaff4783c75"},"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/indiana-university%2Fpuppet-aide","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/indiana-university%2Fpuppet-aide/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/indiana-university%2Fpuppet-aide/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/indiana-university%2Fpuppet-aide/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/indiana-university","download_url":"https://codeload.github.com/indiana-university/puppet-aide/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248348798,"owners_count":21088922,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aide","audit","auditing","cis","cis-benchmarks","file-integrity","ids","intrusion-detection","puppet","puppet-module","security"],"created_at":"2024-11-26T14:16:10.545Z","updated_at":"2025-04-13T16:41:26.812Z","avatar_url":"https://github.com/indiana-university.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# puppet-aide (AIDE - Advanced Intrusion Detection Enviroment).\n[![Build Status](https://travis-ci.com/indiana-university/puppet-aide.svg?branch=master)](https://travis-ci.com/indiana-university/puppet-aide) [![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://GitHub.com/Naereen/StrapDown.js/graphs/commit-activity) [![License](https://img.shields.io/badge/License-BSD%203--Clause-blue.svg)](https://opensource.org/licenses/BSD-3-Clause)\n\n\n#### Table of Contents\n\n1. [Description](#description)\n2. [Setup - The basics of getting started with aide](#setup)\n      * [Setup requirements](#setup-requirements)\n3. [Examples](#examples)\n4. [Cron Entry](#cron)\n5. [Reference - What the module is doing and how](#reference)\n6. [Assigning parameters using Hiera](#hiera)\n7. [Limitations](#limitations)\n8. [Contributing to the development of this module](#contributing)\n9. [Credits](#Credits)\n\n## Description\n\nThis is a module for managing the installation, configuration and initial database creation of [AIDE](https://aide.github.io/) (Advanced Intrustion Detection Environment)package.\n\nAIDE creates a database of files and their attributes from the rules that it finds in its configuration file. Once this database is initialized, it can be used to verify the integrity of the files contained within it. If the file attributes change according to the rules supplied, a summary of changes is logged and can be acted upon.\n\nRefer to the [AIDE manual](https://aide.github.io) for further details about configuration options.\n\nThis module will also add a cron job to periodically run the `aide --check` command to verify the integrity of the AIDE database. Results will be logged to the log file (defaults to `/var/log/aide/aide.log`) and to the AUTH log facility.\n\n### Setup Requirements\n\nThis module requires some additional modules, but it is highly likely that they\nare already installed on your puppet server. They are as follows:\n\n* `puppetlabs/concat` `9.0 - 10.0`\n* `puppetlabs/stdlib` `9.0 - 10.0`\n* `puppet/cron` `1.0 - 5.0`\n\n## Examples\n\nInclude the aide class and set cron run time to 6am with mail to a user other than root.\n----------\n    class { 'aide':\n      minute =\u003e 0,\n      hour   =\u003e 6,\n      day    =\u003e 3,\n    }\n\nInclude the aide class and exclude the ''--config /etc/aide.conf'' argument. \n----------\n\nThis is useful if you are using a 3rd-party security/scanning tool that fails to verify you're running AIDE via a CRON job due to a bad regex on the vendor side.\n\n    class { 'aide':\n      minute                 =\u003e 0,\n      hour                   =\u003e 17,\n      day                    =\u003e 22,\n      exclude_config_argment =\u003e true, \n    }\n\nThis results in the cron job:\n\n    0 17 22 * *  root  nice ionice -c3 /usr/sbin/aide --check\n\ninstead of:\n\n    0 17 22 * *  root  nice ionice -c3 /usr/sbin/aide --config /etc/aide.conf --check\n\nWatch permissions of all files on filesystem\n----------\n\nThe simplest use of `iu/aide` is to place a watch on the root directory, as follows.\n\n    aide::watch { 'example':\n      path  =\u003e '/',\n      rules =\u003e 'p'\n    }\n\nThis example adds the line `/ P` which watches the permissions of all files on the operating system. Obviously, this is a simplistic non useful solution.\n\nNote that the path parameter is optional with the default being the watch name, e.g.\n\n    aide::watch { '/etc':\n      rules =\u003e 'p'\n    }\n\nWatch permissions and md5sums of all files in /etc\n----------\n\n    aide::watch { 'watch etc':\n      path  =\u003e '/etc',\n      rules =\u003e 'p+md5'\n    }\n\nThis example adds the line `/etc p+md5` which watches `/etc` with both permissions and md5sums.  This could also be implemented as follows.\n\n    aide::watch { '/etc':\n      rules =\u003e ['p', 'md5']\n    }\n\nCreate a common rule for watching multiple directories\n-----------\n\nSometimes you wish to use the same rule to watch multiple directories and in keeping up with the Don't Repeat Yourself(DRY) viewpoint, we should create a common name for the rule.  This can be done via the `aide::rule` stanza.\n\n    aide::rule { 'MyRule':\n      name  =\u003e 'MyRule',\n      rules =\u003e ['p', 'md5']\n    }\n    aide::watch { '/etc':\n      rules =\u003e 'MyRule'\n    }\n    aide::watch { 'otherApp':\n      path  =\u003e '/path/to/other/config/dir',\n      rules =\u003e 'MyRule'\n    }\n\nHere we are defining a rule called **MyRule** which will add the line `MyRule = p+md5`.  The next two stanzas can reference that rule.  They will show up as `/etc MyRule` and `/path/to/other/config/dir MyRule`.\n\nCreate a rule to exclude directories\n-----------\n\n    aide::watch { 'Exclude /var/log':\n      path =\u003e '/var/log',\n      type =\u003e 'exclude'\n    }\n\nThis with ignore all files under /var/log. It adds the line `!/var/log` to the config file.\n\nCreate a rule to watch only specific files\n-----------\n\n    aide::watch { '/var/log/messages':\n      type =\u003e 'equals',\n      rules =\u003e 'MyRule'\n    }\n\nThis will watch only the file /var/log/messages.  It will ignore /var/log/messages/thingie. It adds the line `=/var/log/messages MyRule` to the config file.\n\n## Cron\n\nA cron job is created during installation to run aide checks that use the `minute`, `hour`, `day`, `month` and `weekday` parameters to specify the run time.\n\nThis cron job can be disabled by setting the `aide::nocheck` parameter.\n\n## Reference\n\nThe following parameters are accepted by the `::aide` class:\n\n### Installation  Options\n\n#### `package`\n\nData type: String.\n\nAIDE package name.\n\nDefault value: `aide`.\n\n#### `version`\n\nData type: String.\n\nAIDE version for installation passed to Package::ensure\n\nDefault value: `latest`.\n\n### Configuration  Options\n\n#### `conf_path`\n\nData type: String.\n\nLocation of AIDE configuration file\n\nDefault value: `/etc/aide.conf`.\n\n#### `db_path`\n\nData type: String.\n\nLocation of AIDE database file\n\nDefault value: `/var/lib/aide/aide.db`.\n\n#### `db_temp_path`\n\nData type: String.\n\nLocation of update AIDE database file\n\nDefault value: `/var/lib/aide/aide.db.new`.\n\n#### `gzip_dbout`\n\nData type: Boolean.\n\nGzip the AIDE database file (may affect performance)\n\nDefault value: `false`.\n\n#### `aide_path`\n\nData type: String.\n\nLocation of aide binary.\n\nDefault value: `/usr/sbin/aide`.\n\n### `mail_path`\n\nData type: String.\n\nLocation of mail binary.\n\nDefault value: `/usr/bin/mail`.\n#### `config_template`\n\nData type: String.\n\nTemplate to use for aide configuration.\n\nDefault value: `aide/aide.conf.erb`.\n#### `report_ignore_e2fsattrs`\n\nData type: String\n\nList (no delimiter) of ext2 file attributes which are to be ignored in the final report.\n\nDefault value: `undef`\n\n### Logging Options\n\n#### `aide_log`\n\nData type: String.\n\nAIDE check output log.\n\nDefault value: `/var/log/aide/aide.log`.\n\n#### `syslogout`\n\nData type: Boolean.\n\nEnables logging to the system logging service AUTH facility and `/var/log/messages`.\n\nDefault value: `true`.\n\n### Cron scheduling Options\n\n#### `minute`\n\nData type: Cron::Minute (Integer)\n\nMinute of cron job to run\n\nDefault value: `0`.\n\n#### `hour`\n\nData type: Cron::Hour (Integer).\n\nHour of cron job to run\n\nDefault value: `0`.\n\n#### `date`\n\nData type: Cron::Date (Integer).\n\nDate of cron job to run\n\nDefault value: `*`.\n\n#### `month`\n\nData type: Cron::Month (Integer).\n\nMonth of cron job to run\n\nDefault value: `*`.\n\n#### `weekday`\n\nData type: Cron::Weekday (Integer).\n\nDay of week of cron job to run\n\nDefault value: `*`.\n\n#### `nocheck`\n\nData type: Boolean.\n\nWhether to enable or disable scheduled checks\n\nDefault value: `true`.\n\n#### `mailto`\n\nData type: String\n\nSet this vaule to send email of results from aide --check in cron.\n\nDefault value: `undef`\n\n#### `mail_only_on_changes`\n\nData type: Boolean\n\nWhether to only send emails when changes are detected.\n\nDefault value: `false`\n\n#### `max_mail_lines`\n\nData type: Optional[Integer[1]]\n\nIf set to a positive integer, mail messages are truncated to the given number of lines. This can be used to prevent too large mail bodies for large changesets (which may be triggered by OS updates, and not be accepted by the mail server).\n\nDefault value: `undef`\n\n#### `init_timeout`\n\nData type: Integer.\n\nTimeout of \"aide --init\" run.\n\nDefault value: `300`.\n\n### `cat_path`\n\nData type: String.\n\nThe cat command path. This is based on the system\n\nDefault value: `/usr/bin/cat`\n\n### `rm_path`\n\nData type: String.\n\nThe rm command path. This is based on the system\n\nDefault value: `/usr/bin/rm`\n\n### `head_path`\n\nData type: String.\n\nThe head command path. This is based on the system\n\nDefault value: `/usr/bin/head`\n\n\n## Hiera\n\nValues can be set using hiera, for example:\n\n```\naide::syslogout: false\naide::hour: 1\n```\n\n### Tasks\nThe aide module has a task that allows a user to manually initialize aide and copy the database. This is paticular useful when multiple changes are detected on more than one server. The commands the task executes are below and has been tested on Ubuntu.\n```\naideinit\ncp /var/lib/aide/aide.db.new /var/lib/aide/aide.db\n```\n\n## Limitations\n\nThis module currently supports RedHat, CentOS, Debian and Ubuntu Linux but it has been fully tested on Ubuntu 18.04 and Ubuntu 20.04.\n\n## Contributing\n\nPull requests for new functionality or bug fixes are welcome but all code must meet the following requirements:\n  * Is fully tested\n  * All tests must pass\n  * Follows the [Puppet language style guide](https://puppet.com/docs/puppet/latest/style_guide.html)\n\n\n## Credits\n\nThis module was adopted based on the initial refacter work of [Warren Powell](https://github.com/warrenpnz) and [Matt Lauber](https://github.com/mklauber) which uses parameter based classes rather than includes and also includes additional features for:\n  * enabling gzip for database\n  * allow for overrides of aide.conf and cron.d templates\n  * aide logging options\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Findiana-university%2Fpuppet-aide","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Findiana-university%2Fpuppet-aide","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Findiana-university%2Fpuppet-aide/lists"}