Analyzing aide (advanced intrusion detection environment) output with PHP :: a programmer's best friend

The output aide produces when it checks the filesystem against the database looks something like this:

AIDE found differences between database and filesystem!!
Start timestamp: 2006-08-27 12:48:40

Summary:
Total number of files: 78400
Added files: 44
Removed files: 7
Changed files: 958


---------------------------------------------------
Added files:
---------------------------------------------------

...
added: /var/backups/dpkg.status.2.gz
added: /var/backups/dpkg.status.3.gz
...

---------------------------------------------------
Removed files:
---------------------------------------------------

...
removed: /var/backups/dpkg.status.4.gz
removed: /var/backups/dpkg.status.5.gz
...

---------------------------------------------------
Changed files:
---------------------------------------------------

...
changed: /usr/lib/menu
changed: /usr/lib/menu/lynx
...

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------

...
File: /usr/lib/menu/lynx
Mtime : 2005-10-08 13:30:57 , 2006-08-14 01:36:12
Ctime : 2006-06-17 16:14:23 , 2006-08-26 16:19:35
Inode : 5947970 , 5948063
...


It lists some statistics, a list of added, removed and changed files/directories and a detailed summary of what exactly changed.

As mentioned above the summary often contains files/directories that were changed because of updates on our machine. To avoid the tedious task of separating the good ones from the bad ones you can put the output into a file and let Util_AideAnalyzer do the filtering for you. The following code snipped shows you how easy it is.


// necessary includes
require_once '3p/Util/AideAnalyzer.php';
require_once '3p/Util/AideAnalyzer/ItemChecker/Ctime.php';
require_once '3p/Util/AideAnalyzer/ItemChecker/Mtime.php';
require_once '3p/Util/AideAnalyzer/ItemChecker/Composite.php';

// the file containing the results of the aide-check
$file = 'rsrc/check-2006-08-27.txt';

// Analyzed-item checkers to be used in compound
// to sort out valid changes.
$checkers = array(
new Util_AideAnalyzer_ItemChecker_Ctime(strtotime('2006-08-27 12:43:26'), 10),
new Util_AideAnalyzer_ItemChecker_Mtime(strtotime('2006-08-27 12:43:26'), 10),
new Util_AideAnalyzer_ItemChecker_Ctime(strtotime('2006-08-26 00:50:55'), 10),
new Util_AideAnalyzer_ItemChecker_Mtime(strtotime('2006-08-26 00:50:55'), 10),
new Util_AideAnalyzer_ItemChecker_Ctime(strtotime('2006-08-26 16:19:33'), 10),
new Util_AideAnalyzer_ItemChecker_Mtime(strtotime('2006-08-26 16:19:33'), 10));

// a composite analyzed-item checker
$compChkr = new Util_AideAnalyzer_ItemChecker_Composite($checkers);

// creating an analyzer instance and performing analyzation
$analyzer = new Util_AideAnalyzer($file, $compChkr, false);
$analyzer->analyze();

// print the results
echo $analyzer->printTestResult() . "\n\n";
echo $analyzer->printDebugInformation();


You see that I create six item-checker objects (for each date one mtime and one ctime checker) which will sort out items whose mtime/ctime property changed at the given time (with a bias of 10 seconds, which is the second parameter). Each of those three timestamps represents a date/time when I updated the system. Thus the following change aide noticed:

File: /usr/lib/menu/lynx
Mtime : 2005-10-08 13:30:57 , 2006-08-14 01:36:12
Ctime : 2006-06-17 16:14:23 , 2006-08-26 16:19:35
Inode : 5947970 , 5948063

is a valid one, now (compare the ctime-property and keep the 10 second bias in mind).

The rest is as simple as cooking coffee. I take the $checkers array and create a composite checker implementing the Util_AideAnalyzer_AnalyzedItemChecker interface. Then I create an Util_AideAnalyzer instance and call the analyze() method. The rest is just printing out the filtered information which will look like that:

--------------------------------------------------------------------
Invalid items:
--------------------------------------------------------------------

...
File: /etc/postfix/prng_exch
Directory: /root
File: /root/.viminfo
File: /root/.bash_history
File: /root/.rnd
File: /home/luckec/.bash_history
...

--------------------------------------------------------------------
Valid items:
--------------------------------------------------------------------

Directory: /etc
Directory: /etc/alternatives
...

--------------------------------------------------------------------
Analyzation statistics:
--------------------------------------------------------------------

Number of added items : 44
Number of removed items : 7
Number of changed items : 958

Number of valid items : 904
Number of invalid items : 54

Number of added/removed/changed items: 1009
Number of valid/invalid items : 958

I think you will agree that checking the validity of the remaining changed files/directories (invalid items) is done pretty fast as there are only a few left.

If you like what you read feel free to download and install Util_AideAnalyzer. Type


pear channel-discover 3rdpearty.net


Then you will be able to install the package by using:


pear install 3p/Util_AideAnalyzer


Have phun!