pupmod-simp-aide

Table of Contents

• Description
• Setup
  • What aide affects
  • Setup Requirements
• Usage
• Reference
• Limitations
• Development

Description

Sets up a functioning AIDE system.

Breaking changes in 9.0.0

In 9.0.0 the module's blast radius was reduced: a bare include aide now installs only the aide package. It no longer overwrites /etc/aide.conf, writes default rules, creates the database/log/rule directories, or initializes the AIDE database. Everything beyond the package is opt-in.

If you relied on the pre-9.0.0 behavior, there are two ways to restore it:

• Path 1 — set the parameters yourself. Configure the individual /etc/aide.conf parameters (and manage_database => true) as shown under Usage. Best when you want explicit, granular control of exactly which settings the module manages.

• Path 2 — enforce the simp:defaults compliance profile. Set a single Hiera key:

  compliance_engine::enforcement:
    - simp:defaults

  This requires the Sicura Compliance Engine Hiera backend (it is not a hard dependency of this module — metadata.json is unchanged). The profile, shipped in SIMP/compliance_profiles/, restores the full pre-refactor configuration in one step: all /etc/aide.conf settings, the curated default ruleset, the FIPS/non-FIPS group/macro aliases, and database management (manage_database). Values are chosen per OS release (e.g. verbose/database on EL8 vs log_level/report_level/database_in on EL9+) and per FIPS state.

  This profile is opinionated for SIMP sites: enforcing it initializes and updates the AIDE database, which scans the filesystem and is I/O intensive on the first run. Because the profile's values sit at middle Hiera priority, any parameter you set explicitly in your own site Hiera still wins.

Setup

What aide affects

A bare include aide manages only the aide package. It does not modify /etc/aide.conf, manage the AIDE database, create directories, or schedule anything.

When you set the corresponding parameters, the module additionally manages:

• Individual settings in /etc/aide.conf (one managed line per parameter you set, via file_line — the rest of the package-provided file is left alone)
• AIDE rules under /etc/aide.conf.d/ (via aide::rule / default_rules)
• The AIDE database lifecycle, including /var/lib/aide/, /var/log/aide/ and /usr/local/sbin/update_aide (only when manage_database => true)

Setup Requirements

This module requires the following:

• puppetlabs-stdlib
• simp-auditd
• simp-logrotate
• simp-rsyslog
• simp-simplib

Usage

Bare include (safe, package-only)

include aide

This installs the aide package and changes nothing else. It is safe to apply on a host that already has AIDE configured, and the catalog is noop-safe even before the package exists.

Managing individual /etc/aide.conf settings

Each configuration field is its own parameter. Set only the fields you care about; unset (undef) fields are left exactly as the package shipped them.

class { 'aide':
  dbdir        => '/var/lib/aide',
  logdir       => '/var/log/aide',
  database     => 'file:@@{DBDIR}/aide.db.gz',
  database_out => 'file:@@{DBDIR}/aide.db.new.gz',
  gzip_dbout   => 'yes',
  verbose      => 5,
  report_urls  => ['file:@@{LOGDIR}/aide.report'],
}

Version-specific options

Some aide.conf options changed across AIDE releases. Pick the parameter that matches the AIDE version on your nodes:

• database (AIDE 0.18 and older) vs database_in (AIDE 0.19 and newer) — the database option was removed in 0.19 in favor of database_in. Set only the one appropriate for your version.
• verbose (AIDE 0.16 and older) vs log_level + report_level (AIDE 0.17 and newer) — the verbose option was removed in 0.17 in favor of the log_level/report_level pair.

# AIDE 0.19+ / 0.17+
class { 'aide':
  database_in  => 'file:@@{DBDIR}/aide.db.gz',
  log_level    => 'warning',
  report_level => 'summary',
}

Removing a setting

Scalar fields accept the sentinel 'absent' to remove the managed line:

class { 'aide':
  gzip_dbout => 'absent',   # removes the gzip_dbout line
}

The array fields use sibling purge parameters because their values are open-ended:

class { 'aide':
  report_urls_purge => ['file:@@{LOGDIR}/old.report'],
  aliases_purge     => ['LSPP'],
}

Initializing the AIDE database

Building/refreshing the AIDE database is disruptive, so it is opt-in:

class { 'aide':
  manage_database => true,
}

Rules and group/macro definitions (aliases)

Rules and aliases are no longer applied automatically. Opt in by passing them as parameters (for example via Hiera). Representative values:

# Group/macro definitions. On a non-FIPS system you can include sha512:
aide::aliases:
  - 'R = p+i+l+n+u+g+s+m+c+sha512'
  - 'L = p+i+l+n+u+g+acl+xattrs'
  - '> = p+i+l+n+u+g+S+acl+xattrs'
  - 'ALLXTRAHASHES = sha1+sha256+sha512'
  - 'EVERYTHING = R+ALLXTRAHASHES'
  - 'NORMAL = R'
  - 'DIR = p+i+n+u+g+acl+xattrs'
  - 'PERMS = p+i+u+g+acl'
  - 'LOG = >'
  - 'LSPP = R'
  - 'DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha512'

# On a FIPS-enabled system, only sha1/sha256 are available:
# aide::aliases:
#   - 'R = p+i+l+n+u+g+s+m+c+sha1+sha256'
#   - 'ALLXTRAHASHES = sha1+sha256'
#   - ...
#   - 'DATAONLY = p+n+u+g+s+acl+selinux+xattrs+sha1+sha256'

# A curated default ruleset (abbreviated — see git history for the full set):
aide::default_rules:
  - '/boot   NORMAL'
  - '/bin    NORMAL'
  - '/sbin   NORMAL'
  - '/etc    PERMS'
  - '!/etc/mtab'
  - '/etc/passwd   NORMAL'
  - '/var/log   LOG'

Reference

See REFERENCE.md for the full module reference.

Limitations

SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.

Development

Please read our Contribution Guide.

If you find any issues, they can be submitted to our JIRA.