[Aide] AIDE 0.18.8 bugfix release

2024-05-09 Thread Hannes von Haugwitz
AIDE version 0.18.8 was published. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). This is a bugfix release. The most noteworthy changes between v0.18.7 and v0.18.8 are: * Fix

[Aide] AIDE 0.18.7 release

2024-05-04 Thread Hannes von Haugwitz
AIDE version 0.18.7 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.6 and v0.18.7 are: * Add missing library

Re: [Aide] Verifying mounted filesystem

2024-02-28 Thread Hannes von Haugwitz
Hello, On Wed, Feb 28, 2024 at 09:39:14PM +, Sloane, Brandon wrote: > Ideally, I would be able to do something along the > lines of: > > aide --check --config /path/to/aide.conf --root /mnt/sysroot > > and have it behave as if aide was called after doing 'chroot /mnt/sysroot'. > However, I

Re: [Aide] Aide compilation issue: configure: error: AIDE requires mhash or libcrypt for hashsum calculation

2024-02-13 Thread Hannes von Haugwitz
Hi, On Mon, Feb 12, 2024 at 10:49:53PM +, Michael Arguello wrote: > checking for libgcrypt... no > configure: error: libgcrypt not found by pkg-config - Try to add directory > containing libgcrypt.pc to PKG_CONFIG_PATH environment variable > > So, it seems like it can't find libgcrypt, but I

Re: [Aide] Aide compilation issue: configure: error: AIDE requires mhash or libcrypt for hashsum calculation

2024-02-10 Thread Hannes von Haugwitz
Hello, On Fri, Feb 09, 2024 at 03:50:34PM +, Michael Arguello wrote: > This is for Aide version 0.18.6. > > I'm trying to run the instructions in the README file: > $ ./configure > $ make > $ make install > > This is on a fresh CentOS7 minimal system. I installed the requirements > listed

Bug#710970: Please include extended dh_ucf script

2023-12-18 Thread Hannes von Haugwitz
Hello, On Sun, Aug 14, 2022 at 01:16:15PM +0200, Niels Thykier wrote: > Yes, I would still be interested in the improvements if you still feel it > would be worth your time and effort to do them. :) Originally I created the bug/patch to ease the maintenance of the numerous rule files in the aide

Bug#1057309: src:haskell-pandoc binary package names conflict with src:pandoc binary packages

2023-12-02 Thread Hannes von Haugwitz
Source: haskell-pandoc Version: 3.0.1-2 Severity: serious Control: affects -1 src:pandoc Hi, The binary packages provided by src:haskell-pandoc conflict with the binary packages of src:pandoc; violationg Debian Policy 3.1 ("Every package must have a name that’s unique within the Debian

Bug#1057309: src:haskell-pandoc binary package names conflict with src:pandoc binary packages

2023-12-02 Thread Hannes von Haugwitz
Source: haskell-pandoc Version: 3.0.1-2 Severity: serious Control: affects -1 src:pandoc Hi, The binary packages provided by src:haskell-pandoc conflict with the binary packages of src:pandoc; violationg Debian Policy 3.1 ("Every package must have a name that’s unique within the Debian

Bug#1057309: src:haskell-pandoc binary package names conflict with src:pandoc binary packages

2023-12-02 Thread Hannes von Haugwitz
Source: haskell-pandoc Version: 3.0.1-2 Severity: serious Control: affects -1 src:pandoc Hi, The binary packages provided by src:haskell-pandoc conflict with the binary packages of src:pandoc; violationg Debian Policy 3.1 ("Every package must have a name that’s unique within the Debian

Re: [Aide] Monitoring files copy to an USB key

2023-11-11 Thread Hannes von Haugwitz
On Tue, Nov 07, 2023 at 09:34:14AM +, s4il0r wrote: > AIDE seems to be very great for this, except that it haven't find how > to run a check when a file is copied to an usb key. > > Does someone have a clue ? > > Or perhaps there is a better tool for my needs ? AIDE is designed to run on a

Re: [Aide] Excluding directories

2023-11-11 Thread Hannes von Haugwitz
On Tue, Oct 24, 2023 at 10:27:11AM -0700, Jeffrey Shepherd wrote: > Are these recommendations valid? What are the implications of omitting > /opt, /run, and /var? I know (for example) with !/opt an attacker > could come in and place a rootkit in /opt. It depends... If you want to monitor a

[Aide] AIDE 0.18.6 release

2023-08-01 Thread Hannes von Haugwitz
AIDE version 0.18.6 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.5 and v0.18.6 are: * Update GPG key in

Re: Setting APT::Default-Release prevents installation of security updates in bookworm!?

2023-07-22 Thread Hannes von Haugwitz
On Sat, Jul 22, 2023 at 03:56:02PM +0800, Paul Wise wrote: > You will have to ask the apt developers and archive admins about this, > but at the end of the day reverting it is unlikely to happen, so > probably it is something everyone will just have to learn to live with. What about to add a

[Aide] AIDE 0.18.5 release

2023-06-30 Thread Hannes von Haugwitz
AIDE version 0.18.5 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.4 and v0.18.5 are: * Fix child directory

Re: [Aide] config changes between 0.17.3 and 0.18.3

2023-06-28 Thread Hannes von Haugwitz
Hi, On Mon, Jun 26, 2023 at 01:55:06PM -0700, Paul B. Henson wrote: > However, with 18, this only includes /etc in the db and everything else > is skipped: This issue was also reported on Github some weeks ago[ISSUE] and now I was able to reproduce it, I fixed this issue in [cf5026b]. The fix

[Aide] AIDE 0.18.4 release

2023-06-13 Thread Hannes von Haugwitz
AIDE version 0.18.4 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.3 and v0.18.4 are: * Fix handling of

[Aide] AIDE 0.18.3 release

2023-05-16 Thread Hannes von Haugwitz
AIDE version 0.18.3 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.2 and v0.18.3 are: * Handle readlink()

Bug#1034816: aide aborts with error "realloc: failed to allocate memory", exit code 22

2023-05-11 Thread Hannes von Haugwitz
tags 1034816 - moreinfo unreproducible thanks Hi Thomas, On Thu, May 11, 2023 at 05:52:01PM +0200, Thomas Dorner wrote: > I narrowed it further down with some more fprintfs. The problem is not > in do_md.c but the call in hsymlnk in gen_list.c. Yes, yesterday I was able to reproduce your

Bug#1034816: aide aborts with error "realloc: failed to allocate memory", exit code 22

2023-04-26 Thread Hannes von Haugwitz
Hello Thomas, On Wed, Apr 26, 2023 at 07:46:40AM +0200, Thomas Dorner wrote: > > How many files are in the AIDE database on a successful run? Does this > > number significantly differ when the aide check fails? > > You mean the /var/lib/aide/aide.db? > # zcat /var/lib/aide/aide.db | wc > 755240

Bug#1034816: aide aborts with error "realloc: failed to allocate memory", exit code 22

2023-04-25 Thread Hannes von Haugwitz
Hi Thomas, On Tue, Apr 25, 2023 at 10:54:39AM +0200, Thomas Dorner wrote: > The last two daily aide runs on my desktop machine failed with an error > 22. How many files are in the AIDE database on a successful run? Does this number significantly differ when the aide check fails? > Version

Re: [Aide] Protecting multiple containers

2023-04-19 Thread Hannes von Haugwitz
Hello Rick, On Wed, Apr 19, 2023 at 04:54:15PM +, Rick van Rein wrote: > > As this is a common usecase in containerized environments, do we already > > have a "how to handle containers" chapter in our docs? If not, then we > > could invite Rick to contribute to the docs. I am available for >

Re: [Aide] Protecting multiple containers

2023-04-17 Thread Hannes von Haugwitz
Hi Rick, On Mon, Apr 17, 2023 at 10:21:27AM +, Rick van Rein wrote: > > Look at aide 0.18's --limit option, it might be what you want. > > Otherwise, please be more verbose in your wishes and give some simple > > exmples. > > Yes, that is almost exactly what I had in mind. Lovely! > (The

Re: [Aide] Does AIDE traverse Linux symlinks?

2023-04-08 Thread Hannes von Haugwitz
Hello John, On Sat, Apr 08, 2023 at 11:36:59PM -0400, John Jamerson wrote: > If AIDE, by design, traverses Linux symlinks, perhaps there's an > /etc/aide.conf option I've missed or misconfigured? No, AIDE does not follow symlinks. Would it be an option to not only scan /data/app/ but also

[Aide] AIDE 0.18.2 release

2023-04-07 Thread Hannes von Haugwitz
AIDE version 0.18.2 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18.1 and v0.18.2 are: * Add warning if rules

[Aide] AIDE 0.18.1 release

2023-03-04 Thread Hannes von Haugwitz
AIDE version 0.18.1 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.18 and v0.18.1 are: * Fix handling of empty

Re: [Aide] Advanced Log Handling with aide 0.18

2023-03-02 Thread Hannes von Haugwitz
Hi, On Tue, Feb 28, 2023 at 07:13:04PM +0100, Marc Haber wrote: > Here is my suggestion to handle this kind of log rotation: > > Full = p+u+g+ftype+n+i+s+b+l+X+m+c+H > /var/log/apache$ d p+u+g+ftype+n+i+X > /var/log/apache/access\\.log$ f Full+growing+ANF+I > /var/log/apache/access\\.log\\.1$ f

[Aide] AIDE 0.18 release

2023-02-06 Thread Hannes von Haugwitz
AIDE version 0.18 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.17.4 and v0.18 are: * BACKWARDS INCOMPATIBLE

Re: [Aide] Questions about AIDE

2022-12-16 Thread Hannes von Haugwitz
Hello, On Fri, Dec 16, 2022 at 10:12:47AM +, gouki.i...@yokogawa.com wrote: > * How to make check time faster? > In my device, AIDE takes about 3 times longer than Tripwire to check the same > set of files. > Checking contents are R+sha256. > I would like to make check time faster as

Re: [Aide] Call for testing: AIDE prelink support

2022-11-03 Thread Hannes von Haugwitz
On Wed, Nov 02, 2022 at 10:48:37AM -0400, Stephen John Smoogen wrote: > On Wed, 2 Nov 2022 at 10:25, John Horne wrote: > > My understanding though was that prelinking was now basically > > deprecated. We used to use it on CentOS 6 and partly with 7, but, > > as far as I remember, the general

[Aide] Call for testing: AIDE prelink support

2022-11-01 Thread Hannes von Haugwitz
Hello, the upcoming AIDE 0.18 release introduces extensive changes of the hash calculation code (also affecting prelink code). As I'm not familiar with prelink I'm looking for users of the AIDE prelink feature to test the latest version in the development branch[GIT], particularly the new

Bug#1022543: Lower intel-rapl-mmio power limit on ThinkPad T490 since 5.18.0-3-amd64

2022-10-23 Thread Hannes von Haugwitz
Package: src:linux Version: 6.0.3-1 Severity: important Hello, starting with 5.18.0-3-amd64 I experience significant performance loss (clock speed slows down to 400 MHz) on higher CPU usage. After checking for differences I figured out that the long-term intel rapl mmio power limit now defaults

Bug#1022543: Lower intel-rapl-mmio power limit on ThinkPad T490 since 5.18.0-3-amd64

2022-10-23 Thread Hannes von Haugwitz
Package: src:linux Version: 6.0.3-1 Severity: important Hello, starting with 5.18.0-3-amd64 I experience significant performance loss (clock speed slows down to 400 MHz) on higher CPU usage. After checking for differences I figured out that the long-term intel rapl mmio power limit now defaults

Bug#1019977: Please add pipewire-pulse as alternative dependency

2022-09-17 Thread Hannes von Haugwitz
Package: python3-pulsectl Version: 22.3.2-1 Severity: wishlist Hi, pipewire-pulse conflicts on pulseaudio since pipewire/0.3.58-1 (see also #1013276); hence python3-pulsectl can't no longer be installed alongside pipewire. Please consider adding pipewire-pulse as alternative dependency. Best

Bug#710970: [debhelper-devel] Bug#710970: Please include extended dh_ucf script

2022-08-11 Thread Hannes von Haugwitz
Hi Niels, On Wed, Apr 12, 2017 at 10:49:00AM +, Niels Thykier wrote: > Let me know when you have an updated patch. :) Sorry for the long delay. Looks like I still owe you an updated patch. Are you still interested the enhancements? Best regards Hannes

Bug#1011957: aideinit fails in amanda-server processing

2022-05-31 Thread Hannes von Haugwitz
On Tue, May 31, 2022 at 09:36:43PM +0200, Marc Haber wrote: > Hannes, do you want me to commit the fix or do you prefer doing it > yourself? Done via 778c4a0 Best regards Hannes

Bug#1011957: aideinit fails in amanda-server processing

2022-05-31 Thread Hannes von Haugwitz
On Tue, May 31, 2022 at 12:29:04PM +0200, Marc Haber wrote: > how about > >cat --squeeze-blank disklist | while read ... >done > > ? `--squeeze-blank` does only suppress repeated empty lines, (not all blank lines) and does not suppress comment lines. Best regards Hannes

Bug#1011957: aideinit fails in amanda-server processing

2022-05-31 Thread Hannes von Haugwitz
On Mon, May 30, 2022 at 09:46:30AM -0500, Barry Trent wrote: > Applied the patch and added some blank lines back to the disklist. Still > doesn't work. Argh, I overlooked the missing -E flag for grep. Please try again. diff --git a/debian/aide.conf.d/31_aide_amanda-server

Bug#1011957: aideinit fails in amanda-server processing

2022-05-28 Thread Hannes von Haugwitz
Hello Barry, On Sat, May 28, 2022 at 11:34:44AM -0500, Barry Trent wrote: > Yes! Removing all blank (and "#" comment) lines from disklist solved the > problem on 3 different machines. > > So you've found the issue but, of course, blanks and comments are valid in > the disklist and are even

Bug#1011957: aideinit fails in amanda-server processing

2022-05-28 Thread Hannes von Haugwitz
Hi Barry, On Fri, May 27, 2022 at 04:29:54PM -0500, Barry Trent wrote: > *** disklist > zmoby.atcorp.com / comp-root-tar > > symposium.atcorp.com / comp-root-tar > symposium.atcorp.com /bbb

Bug#819295: Please add 'flags_array' struct to public library interface

2022-05-26 Thread Hannes von Haugwitz
Hello, Sorry for my late reply... On Sat, May 06, 2017 at 11:39:56AM -0400, Theodore Ts'o wrote: > Sorry, no. Just to be clear, is what you want is to be able to > convert flag value to a string (instead of printing it to stdio FILE > handle)? Or to go the other way --- e.g., given a charafter

Re: What is the best free HIDS for Debian

2022-05-02 Thread Hannes von Haugwitz
Hi Sylvain, On Mon, May 02, 2022 at 08:11:18PM +0200, Sylvain wrote: > I unsuccessfully tried Tripwire, Aide, Integrit and now OSSEC and OSSEC+. > > All these softs throw errors while running or compiling on my Debian 11.3... Can you please be more specific? What are the errors you get from AIDE

Re: [Aide] Is there any way to compile aide 0.17.x or master/latest on centos8/Almalinux or similar?

2022-04-20 Thread Hannes von Haugwitz
On Tue, Apr 19, 2022 at 11:55:38AM +0200, mg4gh wrote: > I would appreciate if the installation section would contain a list of > other packages that are necessary for the manual installation. > This might help others ... What do you mean by `packages that are necessary for the manual

Re: [Aide] Is there any way to compile aide 0.17.x or master/latest on centos8/Almalinux or similar?

2022-04-18 Thread Hannes von Haugwitz
Hi, On Mon, Apr 18, 2022 at 06:58:57PM +0200, mg4gh wrote: > Remark: When trying to work with the master/latest version, then there > were references to pcre2 and even with installing > "pcre2-devel" the .configure was fine but the compile fails (but ok, > it's no stable version) The latest git

Re: [Aide] Is there any way to compile aide 0.17.x or master/latest on centos8/Almalinux or similar?

2022-04-18 Thread Hannes von Haugwitz
On Sun, Apr 17, 2022 at 10:50:12PM +, John Horne wrote: > Looking at the Aide 0.16 RPM on Rocky, the SPEC file shows that it uses '-- > disable-static'. FWIW the next release (AIDE v0.18) disables static build by default. Best regards Hannes ___

[Aide] AIDE 0.17.4 security release

2022-01-20 Thread Hannes von Haugwitz
AIDE version 0.17.4 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between v0.17.3 and v0.17.4 are: * SECURITY FIX -

[Aide] CVE-2021-45417 - aide (>= 0.13 <= 0.17.3): heap-based buffer overflow vulnerability in base64 functions

2022-01-20 Thread Hannes von Haugwitz
Summary === David Bouman discovered a heap-based buffer overflow vulnerability in base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large (<16k) extended file attributes or ACL. A local user might

Re: [Aide] Integrity check parameters

2021-12-18 Thread Hannes von Haugwitz
Hi, On Sat, Dec 18, 2021 at 03:15:21PM +, Jobet Infosec wrote: > I'm new to Aide. I was wondering about the meaning of the parameters used to > check file integrity: InodeData, StaticFile, RamdiskData, etc... > > Where may I find a detailed description for each one of them? The groups you

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-12-07 Thread Hannes von Haugwitz
Hi, On Mon, Dec 06, 2021 at 02:13:30PM +, Jose M Calhariz wrote: > Sorry for no reply until now. I was busy with issues on work and > personal life. I am happy to adopt logcheck. I am not a user of irc, > there was any discussion on IRC that I should know? No, there were no discussions on

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-12-07 Thread Hannes von Haugwitz
Hi, On Mon, Dec 06, 2021 at 02:13:30PM +, Jose M Calhariz wrote: > Sorry for no reply until now. I was busy with issues on work and > personal life. I am happy to adopt logcheck. I am not a user of irc, > there was any discussion on IRC that I should know? No, there were no discussions on

Re: [Aide] static linking on Linux and Packaging for Distributions

2021-12-05 Thread Hannes von Haugwitz
Hi, On Sat, Sep 11, 2021 at 04:17:33PM +0200, Marc Haber wrote: > aide is traditionally linked statically to protect itself against > trojaned / doctored libraries that might affect the authenticity of the > database and the check results. On Linux, this has not been fully > effective for years

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-12-02 Thread Hannes von Haugwitz
On Sun, Oct 10, 2021 at 06:39:27PM +0200, Hannes von Haugwitz wrote: > @Jose Do you still plan to adopt logcheck? You might want to collaborate > with Richard and Charles to maintain the package all together. @Jose Can you please report back if you still want to maintain logcheck? Best r

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-12-02 Thread Hannes von Haugwitz
On Sun, Oct 10, 2021 at 06:39:27PM +0200, Hannes von Haugwitz wrote: > @Jose Do you still plan to adopt logcheck? You might want to collaborate > with Richard and Charles to maintain the package all together. @Jose Can you please report back if you still want to maintain logcheck? Best r

Bug#992927: mutt: Mutt 2.1.2 is available, fixing a potential data-loss IMAP bug

2021-11-23 Thread Hannes von Haugwitz
Hello, Is there any progress with this bug? Best regards Hannes

Bug#992927: mutt: Mutt 2.1.2 is available, fixing a potential data-loss IMAP bug

2021-11-23 Thread Hannes von Haugwitz
Hello, Is there any progress with this bug? Best regards Hannes

Re: [Aide] How to disable the mail notifications?

2021-11-20 Thread Hannes von Haugwitz
Hello, On Thu, Nov 18, 2021 at 01:44:28AM +, Hg Mi wrote: > We installed AIDE and nullmailer on our system, now we want to > disable the mail notification. Because our system can not send out > the messages, the queued and failed messages consume a lot of disk > space. Could you please

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-10-10 Thread Hannes von Haugwitz
Hi, On Fri, Sep 24, 2021 at 02:42:07PM +0530, Charles wrote: > I would like to adopt the logcheck package On Thu, Sep 23, 2021 at 12:10:16PM +0100, R Lewis wrote: > Very keen to keep logcheck in the distribution and looking to get involved > in Debian (spare time only). > > happy to submit

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-10-10 Thread Hannes von Haugwitz
Hi, On Fri, Sep 24, 2021 at 02:42:07PM +0530, Charles wrote: > I would like to adopt the logcheck package On Thu, Sep 23, 2021 at 12:10:16PM +0100, R Lewis wrote: > Very keen to keep logcheck in the distribution and looking to get involved > in Debian (spare time only). > > happy to submit

Bug#981446: Possible adoption of logcheck

2021-09-05 Thread Hannes von Haugwitz
On Fri, Sep 03, 2021 at 01:46:23PM +0100, Jose M Calhariz wrote: > For now my question is: Who is the upstream that you are using? There is no upstream, since logcheck is a native Debian package (see debian/copyright for details[0]). Best regards Hannes [0]

Bug#981446: Possible adoption of logcheck

2021-09-05 Thread Hannes von Haugwitz
On Fri, Sep 03, 2021 at 01:46:23PM +0100, Jose M Calhariz wrote: > For now my question is: Who is the upstream that you are using? There is no upstream, since logcheck is a native Debian package (see debian/copyright for details[0]). Best regards Hannes [0]

Bug#981446: Possible adoption of logcheck

2021-09-02 Thread Hannes von Haugwitz
Hi Jose, On Mon, Aug 30, 2021 at 07:58:21PM +0100, Jose M Calhariz wrote: > I am a user of logckeck as I use on all my machines that I sysadmin > and I maintain some packages on Debian like for example at and amanda. > > As now I would like to offer my help to package and fix logcheck as a >

Bug#981446: Possible adoption of logcheck

2021-09-02 Thread Hannes von Haugwitz
Hi Jose, On Mon, Aug 30, 2021 at 07:58:21PM +0100, Jose M Calhariz wrote: > I am a user of logckeck as I use on all my machines that I sysadmin > and I maintain some packages on Debian like for example at and amanda. > > As now I would like to offer my help to package and fix logcheck as a >

Re: [Aide] AIDE 0.17.3 released - cygwin, patches, and more?

2021-08-01 Thread Hannes von Haugwitz
On Thu, Jul 29, 2021 at 08:13:01PM -0400, Jason Pyeron wrote: > Would there be any thoughts about providing this as part of Cygwin? I would > be willing maintain the Cygwin build. Please see the Cygwin project website for how to contribute new packages[0]. If AIDE has beed added, feel free to

Re: [Aide] Error checking and package currency.

2021-07-30 Thread Hannes von Haugwitz
Hi, On Fri, Jul 30, 2021 at 06:56:46AM -0400, Vince Heuser wrote: > Is there any script that can check the AIDE rules for syntax, i.e., > "aide-lint"? You can use `--config-check` to check your config (and rules) for errors. To test your rules you can use `--dry-init` and `--path-check` (see

Re: [Aide] Way to list contents of aide.db?

2021-07-30 Thread Hannes von Haugwitz
Hi, On Fri, Jul 23, 2021 at 04:43:10PM -0300, Andreas Hasenack wrote: > is there a way to list the files and directories that are in the aide > database? I wanted to be sure that an explicit inclusion or removal I added > to the config was indeed respected. To test your rules you can use

Re: [Aide] aide.conf: exclude directory *except* one file

2021-03-25 Thread Hannes von Haugwitz
Hello, On Wed, Mar 24, 2021 at 11:00:38AM -0700, M wrote: > Is there any advantage to upgrading to the latest AIDE version (I am > on 0.15.1)? AIDE 0.15.1 has been released over 10 years ago. Please check the NEWS file[0] for the changes since then. > > On Wed, 24 Mar 2021 at 11:44, M wrote: >

[Aide] AIDE 0.17.3 released

2021-02-10 Thread Hannes von Haugwitz
AIDE version 0.17.3 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy change between v0.17.2 and v0.17.3 is: * Fix group usage in

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-01-31 Thread Hannes von Haugwitz
Package: wnpp Severity: normal I would like to put the logcheck package up for adoption. I haven't been using the package for years. If no one speaks up, I eventually will move on with orphaning the package. Feel free to contact me with any questions. The package description is: Logcheck helps

Bug#981446: RFA: logcheck -- mails anomalies in the system logfiles to the administrator

2021-01-31 Thread Hannes von Haugwitz
Package: wnpp Severity: normal I would like to put the logcheck package up for adoption. I haven't been using the package for years. If no one speaks up, I eventually will move on with orphaning the package. Feel free to contact me with any questions. The package description is: Logcheck helps

Bug#912555: reassign 912555 to clamav-freshclam

2021-01-30 Thread Hannes von Haugwitz
reassign 912555 clamav-freshclam thanks Hi, 'ignore.d.server/clamav-freshclam' is part of the clamav-freshclam package. Hence I reassign this bug. Best regards Hannes

[Pkg-clamav-devel] Bug#912555: reassign 912555 to clamav-freshclam

2021-01-30 Thread Hannes von Haugwitz
reassign 912555 clamav-freshclam thanks Hi, 'ignore.d.server/clamav-freshclam' is part of the clamav-freshclam package. Hence I reassign this bug. Best regards Hannes ___ Pkg-clamav-devel mailing list Pkg-clamav-devel@alioth-lists.debian.net

Bug#912550: reassign 912550 to courier-imap

2021-01-30 Thread Hannes von Haugwitz
reassign 912550 courier-imap thanks Hi, 'ignore.d.server/courier-imap' is part of the courier-imap package. Hence I reassign this bug. Best regards Hannes

Bug#973591: logcheck-database: rsyslogd update rule

2021-01-30 Thread Hannes von Haugwitz
reassign 973591 rsyslog forcemerge 927771 973591 thanks Hi, 'ignore.d.server/rsyslog' is part of the rsyslog package. This issue has been reported in #927771 and fixed rsyslog/8.1905.0-3. Best regards Hannes

[Aide] AIDE 0.17 released

2021-01-23 Thread Hannes von Haugwitz
AIDE version 0.17 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between 0.16.2 and 0.17 are: * BACKWARDS INCOMPATIBLE

Re: [Aide] Query over report_url=syslog:

2021-01-19 Thread Hannes von Haugwitz
Hi, On Mon, Jan 18, 2021 at 05:34:36PM +, Fisher, Philip wrote: > My query is that I am using in aide.conf: > > report_url=file: > report_url=syslog:LOCAL6 The `report_url=syslog:` syntax is currently not supported in AIDE upstream. Please check if the binary you are using is patched. > Now

Bug#978448: Static linking fails with undefined reference to `audit_strsplit_r'

2020-12-27 Thread Hannes von Haugwitz
Package: libaudit-dev Version: 1:3.0-1 Severity: normal Control: affects aide Control: block 978245 -1 Dear Maintainer, static linking fails with libaudit-dev 1:3.0-1, due to "undefined reference to `audit_strsplit_r'". Minimal example: $ cat main.c #include #include int main() {

Re: [Aide] Experimenting with exclusion rules

2020-12-18 Thread Hannes von Haugwitz
Hello, On Wed, Dec 16, 2020 at 04:28:09PM -0300, Andreas Hasenack wrote: > Why did the exclusion regexp "!/check/ignore$" ignore the new file > /check/ignore/andreas-was-here? Shouldn't it match just > "/check/ignore" exactly? What am I missing? This is expected behaviour, as children of

Re: [Aide] !/dev rule example

2020-12-18 Thread Hannes von Haugwitz
Hello, On Wed, Dec 16, 2020 at 03:33:03PM -0300, Andreas Hasenack wrote: > the aide.conf(5) manpage says: > > > !/dev > >This ignores the /dev directory structure. > > > Won't that also ignore things like /devandreas-was-here/, /devel and > anything that starts with the

Re: [Aide] WARNING: Old db contains a entry that shouldn't be there, run --init or --update

2020-10-27 Thread Hannes von Haugwitz
On Tue, Oct 27, 2020 at 01:58:35PM -0500, vi...@vheuser.com wrote: > How do I find the offending rule? > There is nothing in the log. > > Is there a cookbook recipe for adding a patch to AIDE version 1.6 > to enable finding the offending rule? The current git HEAD should at least tell you which

Re: [Aide] Change Ownership/Permissions of log directory and files

2020-09-13 Thread Hannes von Haugwitz
Hi, On Wed, Sep 09, 2020 at 09:07:52AM -0400, Paul Carlisle wrote: > Is there a way to configure aide to change the ownership and permissions of > the log directory and files? No, the permissions of the report url depend on the umask and on the user/group of the running AIDE process. Best

Re: [Aide] WARNING: Old db contains a entry that shouldn't be there, run --init or --update

2020-05-04 Thread Hannes von Haugwitz
Hi, On Sat, May 02, 2020 at 09:06:33AM -0400, vi...@vheuser.com wrote: > On 2020/02/25 15:23 PM, Hannes von Haugwitz wrote: > > On Mon, Feb 24, 2020 at 08:32:28PM -0500, vi...@vheuser.com wrote: > > > I've search several times and read dozens of posts > > > from pe

Re: [Aide] WARNING: Old db contains a entry that shouldn't be there, run --init or --update

2020-02-25 Thread Hannes von Haugwitz
Hi, On Mon, Feb 24, 2020 at 08:32:28PM -0500, vi...@vheuser.com wrote: > I've search several times and read dozens of posts > from people asking newbies to post their config. > > What I have not found is the means of troubleshooting this problem. > How does one find the "entry that shouldn't be

Re: [Aide] Strange behaviour

2019-11-20 Thread Hannes von Haugwitz
Hi, On Mon, Nov 18, 2019 at 02:53:17PM +, MAUPERTUIS, PHILIPPE wrote: > [root@otvmi613s aide]# aide -C -Breport_quiet=no -Bsyslog_format=yes There is no 'syslog_format' option in upstream AIDE (or at least I'm not aware of such an option). Are you using a patched AIDE binary? Best regards

[Aide] AIDE 0.16.2 released

2019-05-19 Thread Hannes von Haugwitz
AIDE version 0.16.2 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between 0.16.1 and 0.16.2 are: * Bug fixes - Fix

Bug#901251: IP multicast extended regular expression does not match some matchable lines which are matched online (regexr.com & regextester.com)

2019-03-03 Thread Hannes von Haugwitz
Hi, On Sun, Jun 10, 2018 at 05:28:42PM +0200, jean-christophe manciot wrote: > The rule *ulogd* described below (*IP multicast: 224.0.0.0 <--> > 239.255.255.255*) does not match some matchable lines: > ^.*? DST=2(?:2[4-9]|3\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]\d?|0)){3} .*$ logcheck uses POSIX

Accepted logcheck 1.3.20 (source) into unstable

2019-03-01 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Fri, 01 Mar 2019 23:27:31 +0100 Source: logcheck Architecture: source Version: 1.3.20 Distribution: unstable Urgency: medium Maintainer: Debian logcheck Team Changed-By: Hannes von Haugwitz Closes: 859746 860052 861950 869415

Accepted aide 0.16.1-1 (source) into unstable

2019-02-28 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Thu, 28 Feb 2019 21:34:34 +0100 Source: aide Architecture: source Version: 0.16.1-1 Distribution: unstable Urgency: medium Maintainer: Aide Maintainers Changed-By: Hannes von Haugwitz Closes: 855313 907580 Changes: aide (0.16.1

[Aide] AIDE 0.16.1 released

2019-02-26 Thread Hannes von Haugwitz
AIDE version 0.16.1 has just been released. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). The most noteworthy changes between 0.16 and 0.16.1 are: * Move to GitHub * Update

Bug#895927: sha256 checksum of output database not reproducible with command line tools

2019-02-17 Thread Hannes von Haugwitz
tags 895927 + unreproducible thanks Hi Marc, On Tue, Apr 17, 2018 at 04:13:33PM +0200, Marc Haber wrote: > I would like to verify the database mentioned in aide output before > copying it over to the input database name. That does not seem to work: > > [19/5003]mh@ivanova:~ $ ls -al

Accepted rgxg 0.1.1-5 (source) into unstable

2019-02-09 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Sat, 09 Feb 2019 17:27:25 +0100 Source: rgxg Architecture: source Version: 0.1.1-5 Distribution: unstable Urgency: medium Maintainer: Hannes von Haugwitz Changed-By: Hannes von Haugwitz Changes: rgxg (0.1.1-5) unstable; urgency

Accepted rgxg 0.1.1-4 (source) into unstable

2018-06-21 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Wed, 20 Jun 2018 19:32:35 +0200 Source: rgxg Binary: rgxg librgxg-dev librgxg0 Architecture: source Version: 0.1.1-4 Distribution: unstable Urgency: medium Maintainer: Hannes von Haugwitz Changed-By: Hannes von Haugwitz

Re: [Aide] Hashes for Added and Removed Files?

2018-06-10 Thread Hannes von Haugwitz
On Wed, Jun 06, 2018 at 04:00:46PM +, Ben Brewer (IT - IT_CORE) wrote: > I tried increasing the verbosity to the default (20) and the hashes do not > show up. Please provide more information about your setup: Which OS are you running? Which AIDE version are you using ($ aide --version)?

Accepted rgxg 0.1.1-3 (source) into unstable

2018-06-04 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Mon, 04 Jun 2018 20:30:48 +0200 Source: rgxg Binary: rgxg librgxg-dev librgxg0 Architecture: source Version: 0.1.1-3 Distribution: unstable Urgency: medium Maintainer: Hannes von Haugwitz Changed-By: Hannes von Haugwitz

Accepted logcheck 1.3.19 (source) into unstable

2018-05-30 Thread Hannes von Haugwitz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Wed, 30 May 2018 23:59:13 +0200 Source: logcheck Binary: logcheck logcheck-database logtail Architecture: source Version: 1.3.19 Distribution: unstable Urgency: medium Maintainer: Debian logcheck Team Changed-By: Hannes von

Bug#898478: Please upgrade package to kpcli 3.2

2018-05-12 Thread Hannes von Haugwitz
Package: kpcli Version: 3.1-3 Severity: wishlist Hi, kpcli 3.2 was released in Dec 2017. Please consider to upgrade the package. Thanks. Best regards Hannes

Bug#882066: ansible-lint fails with ansible 2.4

2017-11-18 Thread Hannes von Haugwitz
Package: ansible-lint Version: 3.4.13+git.20170811-1-1 Severity: important Hi, ansible-lint fails with ansible 2.4: $ ansible-lint Traceback (most recent call last): File "/usr/bin/ansible-lint", line 11, in load_entry_point('ansible-lint==3.4.13', 'console_scripts', 'ansible-lint')()

Bug#855313: Invalid option -l

2017-10-29 Thread Hannes von Haugwitz
# fixed in upstream 4863aa9 tags 855313 + fixed-upstream thanks On Sat, Oct 21, 2017 at 12:57:13PM +0200, Marc Haber wrote: > --limit works, and the source code looks correct as well: > { "limit", required_argument, NULL, 'l'}, > > Hannes, that's your issue ;-) Fixed upstream [0] Best

Bug#832159: ITP: qutebrowser -- A keyboard-driven, vim-like browser based on PyQt5.

2017-09-02 Thread Hannes von Haugwitz
Hi, Is there any progress with packaging qutebrowser? Best regards Hannes

Bug#832159: ITP: qutebrowser -- A keyboard-driven, vim-like browser based on PyQt5.

2017-09-02 Thread Hannes von Haugwitz
Hi, Is there any progress with packaging qutebrowser? Best regards Hannes

Bug#819295: Please add 'flags_array' struct to public library interface

2017-05-06 Thread Hannes von Haugwitz
Hi, Is there any progress with this request? Best regards Hannes

Accepted logcheck 1.3.18 (source) into unstable

2017-01-25 Thread Hannes von Haugwitz
-de...@lists.alioth.debian.org> Changed-By: Hannes von Haugwitz <han...@vonhaugwitz.com> Description: logcheck - mails anomalies in the system logfiles to the administrator logcheck-database - database of system log rules for the use of log checkers logtail- Print log file lines that have not been

  1   2   3   4   5   >