@@ -62,13 +62,33 @@ next nightly run will flag it. Re-baseline once the change is |
| 62 | 62 | confirmed-good: |
| 63 | 63 | |
| 64 | 64 | ```sh |
| 65 | | -sudo aideinit -y -f |
| 66 | | -sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz |
| 65 | +# 1. Generate a new baseline (10–15 min on shithub-prod). Use |
| 66 | +# aide --init directly — Ubuntu's aideinit wrapper prompts |
| 67 | +# interactively to confirm the post-init copy and won't be |
| 68 | +# auto-answered by stdin redirection. |
| 69 | +sudo aide --config=/etc/aide/aide.conf --init |
| 70 | + |
| 71 | +# 2. Keep the previous baseline as a dated backup so you can |
| 72 | +# revert tonight's check behavior in 1 second if the new |
| 73 | +# baseline turns out to capture unwanted state. |
| 74 | +sudo mv /var/lib/aide/aide.db /var/lib/aide/aide.db.bak-$(date -u +%Y%m%d) |
| 75 | + |
| 76 | +# 3. Promote. The exact filename suffix depends on the install: |
| 77 | +# Ubuntu 24's aide-common produces uncompressed aide.db.new |
| 78 | +# (no .gz). Adjust if your install differs (check ls |
| 79 | +# /var/lib/aide/ before this step). |
| 80 | +sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db |
| 81 | +sudo chown root:root /var/lib/aide/aide.db |
| 82 | +sudo chmod 0600 /var/lib/aide/aide.db |
| 83 | + |
| 67 | 84 | sudo rm -f /var/lib/aide/.config-changed |
| 68 | 85 | ``` |
| 69 | 86 | |
| 70 | | -The `-y` is "answer yes to all prompts," `-f` is "overwrite an |
| 71 | | -existing new database." Run takes 1–3 minutes on a 4 GB droplet. |
| 87 | +Avoid `aideinit` directly: it prompts twice (`Overwrite existing |
| 88 | +aide.db.new [Yn]?` and `Overwrite /var/lib/aide/aide.db [yN]?`) |
| 89 | +and the second prompt's default is `N`, so any non-interactive |
| 90 | +invocation (cron, nohup, ssh without `-t`) silently bails after |
| 91 | +generating the new database without promoting it. |
| 72 | 92 | |
| 73 | 93 | ## Re-baselining after an Ansible config change |
| 74 | 94 | |
@@ -86,8 +106,13 @@ ansible re-run) and don't want a flood of alerts: |
| 86 | 106 | # Disable for the next 24h |
| 87 | 107 | sudo systemctl stop cron # blunt; you may prefer to mv just the cron entry |
| 88 | 108 | # ... make changes ... |
| 89 | | -sudo aideinit -y -f && \ |
| 90 | | -sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz |
| 109 | +# Re-baseline (see the "Re-baselining" section above for why we |
| 110 | +# call aide --init directly instead of aideinit). |
| 111 | +sudo aide --config=/etc/aide/aide.conf --init |
| 112 | +sudo mv /var/lib/aide/aide.db /var/lib/aide/aide.db.bak-$(date -u +%Y%m%d) |
| 113 | +sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db |
| 114 | +sudo chown root:root /var/lib/aide/aide.db |
| 115 | +sudo chmod 0600 /var/lib/aide/aide.db |
| 91 | 116 | sudo systemctl start cron |
| 92 | 117 | ``` |
| 93 | 118 | |
