[Aide] Questions about AIDE

[Gouki.Itou at yokogawa.com]

Hello Hannes,

> Hard to tell, are you using the same hash algorithm for the comparison (if I remember correctly Tripwire does not support sha2 family hash algorithms).
I compared that.
Aside from R+sha256, I tried R+crc32 that has the same hash algorithm as Tripwire(MD5 and CRC32.)
But its check time was the same as R+sha256, and 3 times longer than Tripwire.

Best regards,
Goki

-----Original Message-----
From: Aide <aide-bounces at ipi.fi> On Behalf Of Hannes von Haugwitz
Sent: Saturday, December 17, 2022 5:38 AM
To: Aide user mailinglist <aide at ipi.fi>
Subject: Re: [Aide] Questions about AIDE

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


Hello,

On Fri, Dec 16, 2022 at 10:12:47AM +0000, Gouki.Itou at yokogawa.com wrote:
>   *   How to make check time faster?
> In my device, AIDE takes about 3 times longer than Tripwire to check the same set of files.
> Checking contents are R+sha256.
> I would like to make check time faster as possible.

Hard to tell, are you using the same hash algorithm for the comparison (if I remember correctly Tripwire does not support sha2 family hash algorithms).

>   *   How to stop checking if aide.db is changed?
>
> I also would like not to check files if aide.db is edited by someone.

Currently there is no signing support for config or database files (see corresponding feature request [0]).

In the meantime you have to manually compare the database checksums provided in the report output.

> Here is my device spec:
> CPU: ARM Cortex-A53 2core
> MEM: 2 GB
> Aide version: 0.16.2

AIDE v0.16.2 has been released over 3 years ago, please consider to use the latest stable release.

Best regards

Hannes

[0] https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faide%2Faide%2Fissues%2F7&data=05%7C01%7Cgouki.itou%40yokogawa.com%7Cbb184f2d42f147a2929f08dadfa57f1a%7C0da2a83b13d94a35965fec53a220ed9d%7C0%7C0%7C638068199163453632%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=S60ykoVT76M%2BpB%2BerRcq8JAO5bwcaxFwRF1mhT8zUQY%3D&reserved=0
_______________________________________________
Aide mailing list
Aide at ipi.fi
https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ipi.fi%2Fmailman%2Flistinfo%2Faide&data=05%7C01%7Cgouki.itou%40yokogawa.com%7Cbb184f2d42f147a2929f08dadfa57f1a%7C0da2a83b13d94a35965fec53a220ed9d%7C0%7C0%7C638068199163453632%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=i5oZSnCQxY2k83lhujOuv3oo9VpkeOQGUznxlzFOylM%3D&reserved=0
-----
CONFIDENTIAL: This e-mail may contain information that is confidential or otherwise protected from disclosure and intended only for the party to whom it is addressed. If you are not the intended recipient, please notify the sender by return and delete this e-mail. You are hereby formally advised that any unauthorized use, disclosure or copying of this email is strictly prohibited and may be unlawful.