<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I used AIDE as a STIG requirement and use it for the most part in its default configuration. I came across some Openstack documentation that makes the following notes:<div class=""><br class=""></div><div class=""><div class=""># The default Ubuntu configuration for AIDE will cause it to wander into some</div><div class=""># terrible places on the system, such as /var/lib/lxc and images in /opt.</div><div class=""># The following three default exclusions are highly recommended for AIDE to</div><div class=""># work properly, but additional exclusions can be added to this list if needed.</div><div class="">security_aide_exclude_dirs:</div><div class=""> - /openstack</div><div class=""> - /opt</div><div class=""> - /run</div><div class=""> - /var</div><div class=""><br class=""></div><div class="">Are these recommendations valid? What are the implications of omitting /opt, /run, and /var? I know (for example) with !/opt an attacker could come in and place a rootkit in /opt. But couldn’t an attacker just check aide.conf and find an excluded directory to put their rootkit in?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div>v/r<br class=""><b class="">Jeff Shepherd</b></div><div><a href="mailto:shepherd@spawar.navy.mil" class="">shepherd@spawar.navy.mil</a></div><div class="">FS: <a href="mailto:jeffrey.k.shepherd.ctr@us.navy.mil" class="">jeffrey.k.shepherd.ctr@us.navy.mil</a></div></div></div></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>