-
Notifications
You must be signed in to change notification settings - Fork 0
/
NEWS
261 lines (207 loc) · 12.5 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
aide (0.18.1-1) unstable; urgency=medium
The aide cron job does no longer run as root. On systemd systems,
this means that no mail is sent out by default but a warning is
written to the journal instead unless s-nail is installed and a local
MTA is present. This affects already installed systems as well as
new installs..
Manual intervention is required to have the daily cron job send
mail as it has been the default previously.
This affects new installs as well as upgraded installations. See
README.Debian for a detailed explanation.
-- Marc Haber <[email protected]> Mon, 13 Mar 2023 14:41:41 +0100
aide (0.17.3-5) unstable; urgency=medium
The aide binary installed by the aide.deb is no longer statically
linked. The aide-dynamic.deb is a transitional package that pulls
in aide.deb. There is no statically linked binary any mode.
For more details and explanation, see README.Debian
-- Marc Haber <[email protected]> Sun, 28 Nov 2021 13:53:02 +0100
aide (0.17-2) unstable; urgency=medium
The Debian configuration had the whirlpool checksum disabled due to
failures on sparc and sparc64 back in the 200x years. This issue was
solved long ago, and we have enabled whirlpool in the current default
configuration.
Until you successfully --update your databases, every file in your
database will be reported as "has different attributes". The rest of
the report will be accurate and the whirlpool checksum not be subject
of a --check.
-- Marc Haber <[email protected]> Wed, 27 Jan 2021 15:51:31 +0100
aide (0.17-1) unstable; urgency=medium
In aide 0.17, the configuration parser had a major update. Some
incompatibilites have been unavoidable. Most prominent change is
new behavior regarding quoting of special characters in rules.
See the upstream NEWS file /usr/share/doc/aide-common/NEWS.gz for details.
Most of the functionality of update-aide.conf and the aide.wrapper
has moved into aide proper. The two scripts have been removed. This also
means that the @@{ROOTPREFIX} prefix is no longer added to every rule
written in the configuration. If you have been using this feature, please
consider one of these alternatives:
- the root_prefix configuration option allows you to specify a single
prefix
- write your own tool that, for example, copies the contents of
/etc/aide/aide.conf.d to /etc/aide/aide.conf.container.d and does the
appropriate preprocessing of the copied rules.
- write/generate your own per-container ruleset in a different directory
and @@x_include it appropriately.
If none of these suggestions looks acceptable for you, please file
a wishlist bug report and let us know what is missing.
-- Marc Haber <[email protected]> Sun, 17 Jan 2021 16:29:27 +0100
aide (0.16~b1-1) unstable; urgency=medium
BACKWARDS INCOMPATIBLE CHANGES
Negative selection lines of the form '!<regex> <groups>' are no longer
supported (use '!<regex>' instead). The affected config files in the
aide-common package (31_aide_ntp-server, 31_aide_inn2) have been fixed.
The switch to Perl 5 Compatible Regular Expressions and the fix of
'.*'-rule matching may result in different rule matching behaviour.
Apart from that the options report_attributes and ignore_list has been
deprecated (use report_force_attrs and report_ignore_changed_attrs
instead).
-- Hannes von Haugwitz <[email protected]> Sun, 17 Apr 2016 09:13:09 +0200
aide (0.14.2.git20100726-1) unstable; urgency=low
The important changes since last NEWS entry are:
- aide is now checking the file type and file attributes on
a Linux second extended file system
- the checksum whirlpool has been disabled as it is broken on sparc
and sparc64
- the files in the report are now sorted by filename
- new group definition: VarDirTime
- new upstream grouped feature to disable the grouping in the report
- new command 'aide-attributes' (see man page for details)
Due to the above changes in configuration, you may want to
update your database (the way you usually do it) to avoid
thousands of "different attribute" warnings.
-- Hannes von Haugwitz <[email protected]> Wed, 28 Jul 2010 11:58:58 +0200
aide (0.14~rc3-1) unstable; urgency=low
In this release, a lot of things have changed. Most changes were
inspired and done by Hannes von Haugwitz, who has been a real big help
in preparing the new version of aide, both for Debian and upstream.
The important changes in this release are:
- added aide.settings.d
Some rules delivered by the aide distributions can be
parametrized. These parameters used to be in the rule directory
itself, but were moved to /etc/aide/aide.settings.d with this
version of the package. Old parameter files still sitting in the
rule directory will take precedence, but trigger a warning. You
may want to review your parameter files and adapt them.
- /etc/default/aide has new options: TRUNCATEDETAILS, FILTERUPDATES,
FILTERINSTALLATIONS, LINES=0, UPAC_SETTINGSD. They are
documented in the file itself.
- many, many updated and new rules
- new group definitions: VarTime, VarInode, VarDirInode
- aide is now checking the target of symbolic links (link name)
- On systems supporting these features aide is now checking ACLs,
extended attributes and selinux attributes.
- The obsolete checksums md5 and sha-1 have been replaced by
sha256 and sha512.
- The upstream summarize_changes feature is disabled by default to
avoid changing the output format, but it may be enabled in a
future release. We would appreciate testing of the new feature, so if
you feel like it, please enable it manually in aide.conf
- The daily e-mail now includes the log file checksum to detect
modifications of the log file on the target system.
Due to the numerous changes in configuration, you may want to
update your database (the way you usually do it) to avoid
thousands of "different attribute" warnings.
-- Marc Haber <[email protected]> Thu, 25 Feb 2010 11:37:02 +0100
aide (0.13.1-10) unstable; urgency=low
The aide configuration now sets a macro called YEAR4D to the four
digit current year, and makes use of that macro in the
configuration files where a year is included in a file name. This
means that you do not need to adapt your configuration over the
new year and still only exclude files that are concerned with the
current year. However, you'll get a whole bunch of "file changed"
and "new file" reports on new year. If you don't like to manually
accept these changes on new year, you can manually set YEAR4D to a
regexp covering the years you don't want reported.
In the course of this change, configuration that still acted on
2006's files only has been fixed. Sheesh.
-- Marc Haber <[email protected]> Sun, 23 Mar 2008 10:07:14 +0100
aide (0.12.20061123-0) unstable; urgency=low
aide now suports a new hash called whirlpool which is enabled in
the default config. This means that aide --update|--check is going
to complain about database entries with different attributes. The
final aide output will be correct though, so it is advised to update
your databases after installing this package.
-- Marc Haber <[email protected]> Fri, 24 Nov 2006 14:35:46 +0100
aide (0.11a-4) unstable; urgency=low
This version has changed the way that the Debian configuration is
handled with regard to local configurations that might be used to
have additional, local checks.
The AIDE binary is /usr/bin/aide again, and the wrapper handling
locking and special configuration processing is now aide.wrapper.
The scripts delivered with the Debian package now invoke
aide.wrapper to make explicit use of the wrapper. aide is now
compiled to use a non-existing directory and a non-existing
configuration file by default, which will lead to an error message
if invoked parameterless. This is a feature designed to avoid
accidental tampering with the Debian databases.
The advantage of this change is that /usr/bin/aide now behaves
exactly as upstream AIDE again, removing Debian specialties for
people who are not accustomed to the Debian configuration. If you
use AIDE in a special way, with your own configuration and your
own database directory, you'll likely have to change your
procedures.
-- Marc Haber <[email protected]> Fri, 26 May 2006 11:11:40 +0000
aide (0.11a-3) unstable; urgency=low
Starting with aide 0.11a-2, aide's default configuration has been
changed. Previously, AIDE did only superficial checks of the
static parts of the file system. Now, the entire file system is
included, and the changing parts of the file system are excluded
from the check. We are changing from a "forbid all possibly
dangerous changes" stance to a "allow only changes that we know
are harmless" stance.
Please note that this might significantly increase aide's
execution times as we now check the whole file system by default.
On systems with big, changing file systems (like shell servers or
big ftp or web servers), you might want to exclude parts of the
file system to bring execution times down to an acceptable level.
This is not done in the default configuration since AIDE aims for
maximum security by default, and big data directories are a
preferred target for crackers to place their root kit binaries. An
example rule file to exclude home directories of users with uid >=
1000 is included in the package and might be put into use at the
local admin's discretion.
To allow better updateability, a split configuration scheme has
been introduced with aide 0.10-5, which is now being put into use
for the default configuration. /etc/aide.conf is reduced to
default definitions, while the real work is being done in the
configuration snippets in /etc/aide/aide.conf.d.
The contents of /etc/aide/aide.conf.d has already been split to
reflect which package contains the files that change too
frequently to be part of a regular check. This allows moving these
configuration snippets into the respective packages at a later
time.
You might want to accept all conffile changes that are offered
with this update, or otherwise your AIDE will most probably stop
working.
The new rule sets in 0.11a-2 have been extensively tested on my
productive systems. However, since my productive systems are all
reasonably similar, the new rule sets may not be fully suitable
for other people's systems. Please do not hesitate to file bugs
against aide if your AIDE reports include excessive changes that
should not be flagged as such. Don't forget to include
configuration and report snippets that might help in devising the
new rules. These bugs will be usertagged in the BTS with
"2006-04-configuration" for [email protected].
Chances are that you don't have all packages installed that are
taken care of by AIDE's default configuration. That way, you might
end up excluding more parts of the namespace than you would need
for your system, but the AIDE protection is still working on a
broader basis than it did with the old configuration. If you are
paranoid, you might want to either delete the config snippets you
don't use (ucf should notice that and not re-install the files on
update) or create your own conf.d directory (like
/etc/aide/aide.conf.local.d), symlink the snippets you want in
there and point aide towards the new conf.d directory by setting
UPAC_CONFD in /etc/default/aide. This last option is the way I
have chosen for my personal systems.
Package maintainers, if you intend to deliver your own aide.conf.d
snippet in your package, please put your package name after the
number (31_aide_foo => 31_foo_something) to avoid a namespace
clash and file a bug against aide so indicate that aide can remove
its config snippet. It does not hurt to have both installed, so
there is no need to coordinate.
The source package can optionally build a package aide-config-zg2,
which contains rules that are probably only suitable on my
systems. Of course, building of aide-config-zg2 is disabled by
default.
-- Marc Haber <[email protected]> Fri, 26 May 2006 11:05:10 +0000