Detect intrusions with AIDE

Deploy AIDE (Advanced Intrusion Detection Environment) AIDE on the data plane nodes to check the integrity of files and directories and detect unauthorized file access. AIDE analyzes system files and compiles an integrity database of file hashes.

The control plane services run as pods on Red Hat OpenShift Container Platform (RHOCP), where file integrity is managed by OpenShift container image signatures and SecurityContextConstraints. RHOSO does not include a built-in AIDE service equivalent to the director OS::TripleO::Services::Aide integration that is available in previous versions of Red Hat OpenStack Platform (RHOSP). To deploy AIDE on your data plane nodes, create a custom data plane service that uses Ansible to install and configure AIDE on each node.

Deploy AIDE intrusion detection on data plane nodes
Copy link

You can create an OpenStackDataPlaneService custom resource (CR) that uses Ansible to install AIDE (Advanced Intrusion Detection Environment), configure an integrity database, and schedule periodic integrity checks on your data plane nodes.

Before you begin
Copy link

  • You are logged on to a workstation that has access to the Red Hat OpenStack Services on OpenShift (RHOSO) control plane as a user with cluster-admin privileges.

Procedure
Copy link

  1. Create a ConfigMap CR that contains the AIDE configuration rules you want to apply to your data plane nodes. Create a file on your workstation, for example, aide-config.yaml. Select AIDE rules and monitored paths that suit your specific security requirements. The following example is illustrative and is not actively maintained or benchmarked: 
    apiVersion: v1
kind: ConfigMap
metadata:
  name: aide-config
  namespace: openstack
data:
  aide.conf: |
    @@define DBDIR /var/lib/aide
    @@define LOGDIR /var/log/aide
    database=file:@@{DBDIR}/aide.db.gz
    database_out=file:@@{DBDIR}/aide.db.new.gz
    gzip_dbout=yes
    report_url=file:@@{LOGDIR}/aide.log
    report_url=stdout

    CONTENT_EX = sha256+ftype+p+u+g+n+acl+selinux+xattrs

    /boot/   CONTENT_EX
    /etc/    CONTENT_EX
    /sbin/   CONTENT_EX
    /usr/sbin/ CONTENT_EX
    /var/    CONTENT_EX

    !/var/log.*
    !/var/spool.*
    !/var/adm/utmp$
    !/var/lib/nova/instances.*
  2. Apply the ConfigMap to your Red Hat OpenShift Container Platform (RHOCP) cluster: 
    $ oc apply -f aide-config.yaml -n openstack
  3. Create the OpenStackDataPlaneService CR for AIDE. Create a file on your workstation, for example, aide-service.yaml. The following example overwrites the logs daily. You could configure a different log retention policy and plan storage accordingly: 
    apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneService
metadata:
  name: aide
  namespace: openstack
spec:
  dataSources:
    - configMapRef:
        name: aide-config
  playbookContents: |
    - hosts: all
      become: true
      tasks:
        - name: Install AIDE
          ansible.builtin.dnf:
            name: aide
            state: present

        - name: Deploy AIDE configuration
          ansible.builtin.copy:
            src: /var/lib/openstack/configs/aide/aide.conf
            dest: /etc/aide.conf
            owner: root
            group: root
            mode: '0600'

        - name: Initialize AIDE database
          ansible.builtin.command:
            cmd: aide --init
            creates: /var/lib/aide/aide.db.new.gz

        - name: Activate AIDE database
          ansible.builtin.copy:
            src: /var/lib/aide/aide.db.new.gz
            dest: /var/lib/aide/aide.db.gz
            remote_src: true

        - name: Configure AIDE cron job
          ansible.builtin.cron:
            name: "AIDE integrity check"
            hour: "4"
            minute: "0"
            job: "/usr/sbin/aide --check > /var/log/aide/aide-check.log 2>&1"
            user: root
  4. Apply the AIDE service to your cluster: 
    $ oc apply -f aide-service.yaml -n openstack
  5. Create a new OpenStackDataPlaneDeployment CR to deploy the updated node set configuration, for example aide-deployment.yaml: 
    apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: aide-deployment
  namespace: openstack
spec:
  nodeSets:
    - openstack-edpm-ipam
  servicesOverride:
    - aide
  6. Apply the change: 
    $ oc apply -f aide-deployment.yaml -n openstack
  7. Monitor the Ansible execution: 
    $ oc logs -l app=openstackansibleee -n openstack -f --max-log-requests 10

AIDE database updates
Copy link

If you modify the configuration of your data plane nodes, you must reinitialize the AIDE database. Otherwise, AIDE reports legitimate changes as integrity violations. Create a new OpenStackDataPlaneDeployment CR that runs only the aide service with the servicesOverride field.

apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: aide-reinit
  namespace: openstack
spec:
  nodeSets:
    - openstack-data-plane
  servicesOverride:
    - aide
Note
The aide --init task in the example playbook uses the creates parameter to skip initialization if the database already exists. To force reinitialization, you must modify the playbook to remove the existing database first, or create a separate reinitialization service.

Control plane integrity verification
Copy link

You do not use AIDE (Advanced Intrusion Detection Environment) on the control plane. Control plane services run as container images on Red Hat OpenShift Container Platform (RHOCP). To verify the integrity of the control plane:

  • Use OpenShift container image signature verification to ensure that images have not been tampered with.
  • Use the File Integrity Operator (FIO) on RHOCP worker nodes that host OpenStack pods to detect unauthorized changes to the underlying node filesystem.
  • Review pod security admission and SecurityContextConstraints to ensure containers cannot modify the host filesystem.