0

请原谅我的英语^^'

我正在尝试回答我的标题问题。

有我的 /etc/aide/aide.conf 的内容:

# AIDE conf

# The daily cron job depends on these paths
database=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new
database_new=file:/var/lib/aide/aide.db.new
gzip_dbout=no

# Set to no to disable summarize_changes option.
summarize_changes=yes

# Set to no to disable grouping of files in report.
grouped=yes

# standard verbose level
verbose = 6

# Set to yes to print the checksums in the report in hex format
report_base16 = no

# if you want to sacrifice security for speed, remove some of these
# checksums. Whirlpool is broken on sparc and sparc64 (see #429180,
# #420547, #152203).
Checksums = sha256+sha512+rmd160+haval+gost+crc32+tiger

# The checksums of the databases to be printed in the report
# Set to 'E' to disable.
database_attrs = Checksums

# check permissions, owner, group and file type
OwnerMode = p+u+g+ftype

# Check size and block count
Size = s+b

# Files that stay static
InodeData = OwnerMode+n+i+Size+l+X
StaticFile = m+c+Checksums

# Files that stay static but are copied to a ram disk on startup
# (causing different inode)
RamdiskData = InodeData-i

# Check everything
Full = InodeData+StaticFile

# Files that change their mtimes or ctimes but not their contents
VarTime = InodeData+Checksums

# Files that are recreated regularly but do not change their contents
VarInode = VarTime-i

# Files that change their contents during system operation
VarFile = OwnerMode+n+l+X

# Directories that change their contents during system operation
VarDir = OwnerMode+n+i+X

# Directories that are recreated regularly and change their contents
VarDirInode = OwnerMode+n+X

# Directories that change their mtimes or ctimes but not their contents
VarDirTime = InodeData

# Logs grow in size. Log rotation of these logs will be reported, so
# this should only be used for logs that are not rotated daily.
Log = OwnerMode+n+S+X

# Logs that are frequently rotated
FreqRotLog = Log-S

# The first instance of a rotated log: After the log has stopped being
# written to, but before rotation
LowLog = Log-S

# Rotated logs change their file name but retain all their other properties
SerMemberLog  = Full+I

# The first instance of a compressed, rotated log: After a LowLog was
# compressed.
LoSerMemberLog = SerMemberLog+ANF

# The last instance of a compressed, rotated log: After this name, a log
# will be removed
HiSerMemberLog = SerMemberLog+ARF

# Not-yet-compressed log created by logrotate's dateext option:
# These files appear one rotation (renamed from the live log) and are gone
# the next rotation (being compressed)
LowDELog = SerMemberLog+ANF+ARF

# Compressed log created by logrotate's dateext option: These files appear
# once and are not touched any more.
SerMemberDELog = Full+ANF

当我执行以下命令时,我不明白为什么 AIDE 会在新数据库中添加超过 400.000 个条目:update-aide.conf ; aideinit 在配置文件中没有选择行或受限选择行,所以我想知道 AIDE 是否不添加一些默认。

我在 Ubuntu 18.04.4 上,所以包助手附带了 aide-common 包装包。我想要一个干净的 aide.conf 文件,但是当我尝试删除时SerMemberDELog = Full+ANF,例如,我收到以下错误:

846:Error in expression:

Configuration error
error checking aide config, not running aide
AIDE --init return code 255

非常感谢任何会帮助我的人:)!如果您需要更多详细信息,我总是在这里。

4

1 回答 1

0

最后我设法解决了我的问题,/etc/aide/aide.conf 配置文件不是 AIDE 使用的唯一文件,当你运行update-aide.conf包装器时,它实际上使用了这个文件和 /etc/ 中存在的许多其他 conf 文件aide/aide.conf.d 目录。简单的解决方法是移动或删除这些文件,从现在起您将能够清理您的 /etc/aide/aide.conf 文件 :)

祝你有美好的一天 !

于 2020-04-27T16:08:05.450 回答