A week ago I suggested installing AIDE to track changes on your server in case it had been hacked. I think AIDE Is so useful that it deserves a post of it’s own. Here’s a short guide to get it working properly.
The AIDE .deb package includes configuration files for over 80 different software packages or log files. That’s great if you have all that software installed or want to keep a paranoid eye on /var but what if you only care about the directory where your website lives?
When I first installed AIDE (using apt-get install aide), it said I needed to run /usr/sbin/aideinit after installation. Every morning I’d get an email from AIDE with a list of changed files from all over my server, including mail logs, Apache logs, and more. I didn’t need all that so I removed the files from /etc/aide.conf.d/ except my WordPress config file:
/home/web/ Checksums
!/home/web/logs/.*
!/home/web/public_html/wp-content/cache/.*
!/home/web/.*/htdocs/wp-content/cache/.*
Unfortunately after I removed the configuration files the daily AIDE email was flooded with open_dir() errors:
Output is 40577 lines, truncated to 1000.
open_dir():Not a directory: /home/donncha/.bashrc
open_dir():Not a directory: /home/donncha/.bash_profile
open_dir():Not a directory: /home/donncha/.viminfo
open_dir():Not a directory: /home/donncha/.bash_history
AIDE was rendered useless by all the errors. Thankfully it was easy to fix. Run aideinit again and it regenerates the AIDE database.
# /usr/sbin/aideinit
Overwrite existing /var/lib/aide/aide.db.new [Yn]? y
Running aide –init…AIDE, version 0.13.1
### AIDE database at /var/lib/aide/aide.db.new initialized.
Overwrite /var/lib/aide/aide.db [yN]? y
For good measure, I ran /etc/cron.daily/aide again which sent me the “Daily AIDE report”, and yes, it reported that my .htaccess file had been changed. Nice.
If your site is on a shared hosting account then you’re out of luck, but if you have a dedicated host, or virtual private server (VPS) then please consider using AIDE to keep track of changed files. It will send you a short email every day listing changed, added or deleted files. It may save you a lot of hassle and embarrassment if your site is hacked.
Edit: By default, the nightly cron script doesn’t update the AIDE database leading to the same files changes reported every day. Edit /etc/default/aide and make sure COPYNEWDB is set to “yes”. That will update the database.
If you like this post then please subscribe to my full RSS feed. You can also click here to subscribe by email. There are also my fabulous photos and funny videos to explore too!
This is the personal blog of Donncha O Caoimh, Irish WordPress developer and sometimes Photographer.
Excellent, really useful, I’ll be using this for all my WP installs from now on.
After your last post on this subject, I was thinking that it would be a good idea for Automattic to create a plugin that carries out all the checks you suggested people do to find out if they’ve been hacked – obviously, the vast majority of people won’t know or won’t bother and, in the long run, that hurts the reputation of WP. A plugin that makes doing the right thing easier would, of course, lessen the damage.
Forgive me for being a bit stupid if this isn’t the same kind of thing… A WP plugin (called TripWire) that looks like it does the same job – albeit much easier to install.
http://herselfswebtools.com/2008/06/wordpress-plugin-tripwire.html
I notice it’s the second in a three-part series of security plugins which look very useful indeed.
Is there any difference between the functionality of the one mentioned above and AIDE?
Piggy – it’s similar, but AIDE goes further.
First of all, AIDE has a database of file checksums. It runs md5 and various other checksum algorithms on the files you list, and uses that checksum to figure out what files have changed. The plugin above simply checks the file modification time which can be easily spoofed using touch().
Second, AIDE has to be run as root (well, you could install it in a home directory as an ordinary user too, but I digress) which offers some protection against the database being compromised by the webserver user. Even if a PHP application recorded md5 checksums of all it’s files, you could never trust the database because it would have to be owned by the webserver and therefore at risk of being modified by a hacker.
That said, if you can’t install AIDE, then you should use a plugin like that. It would be really nice if it emailed the administrator once every 24 hours with a list of changed files.
Hmmm, I’m thinking it would be really useful if, aswell as having a plugin email the admin, if the emails were also CC’d to a central server that could treat them as incoming reports, track the trends and, then, when another rash of attacks hits, could send additional warning emails to people whose emails seemed to indicate a likely attack.
Donncha, is something like that ever likely to be instituted or does Automattic tend to be more hands-off, culturally?
Donnacha – unfortunately it might have a lot of privacy issues as POST requests include usernames and passwords.
It’s probably hard, but not impossible, to see a hack attempt in progress. A central db might be useful but it would require a lot of resources.
[...] Donncha provided a page that covers the issue succinctly and today he added another post on setting up aide. His two posts are good and anyone considering monitoring their WordPress files for modification [...]
Is AIDE available for CentOS or Redhat system? I want to try it in CentOS/Redhat system
@Kate, I found this article which suggests that it’s extremely simple:
http://www.bofh-hunter.com/2008/04/10/centos-5-and-aide/
… but I haven’t actually got around to implementing it on any of my CentOS systems yet.
[...] Catch website file changes with AIDE [...]
As you said “If your site is on a shared hosting account then you’re out of luck”
I think some one must provide features brought to by AIDE into an easier manner. I didn’t think I was harder, but I use shared hosting
md5mon does something similar, if not identical. Ive been using it for a while.
http://freshmeat.net/projects/md5mon/