AIDE (Advanced Intrusion Detection Environment) takes a snapshot of your system files, including hashes, permissions, owners and timestamps, and later reports every difference. If an attacker replaces /usr/bin/sshd, adds a cron job or edits /etc/passwd, AIDE tells you. It’s a classic, lightweight file integrity monitoring (FIM) tool, often required by compliance standards.

Install

sudo apt install aide           # Debian/Ubuntu
sudo dnf install aide           # RHEL family

Create the baseline database

Build it on a system you trust, ideally right after setup and hardening:

Debian/Ubuntu:

sudo aideinit                           # builds /var/lib/aide/aide.db.new and installs it as aide.db

RHEL family:

sudo aide --init
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

It reads every file in the monitored paths, which can take a few minutes. Run it at a quiet time.

Check for changes

sudo aide --check                       # RHEL family
sudo aide -c /etc/aide/aide.conf --check   # Debian/Ubuntu

A clean result:

AIDE found NO differences between database and filesystem. Looks okay!!

A report with changes:

Summary:
  Total number of entries:      152304
  Added entries:                3
  Removed entries:              0
  Changed entries:              2

Added entries:
f++++++++++++++++: /etc/cron.d/sysupdate
Changed entries:
f   ...    .C... : /usr/bin/ss
f   ...    .C... : /etc/passwd

Letters show what changed: C checksum, p permissions, u user, g group, m modification time, s size.

An unexpected new cron file and a changed ss binary together look like a compromise. A changed /etc/passwd right after you added a user is expected.

Daily automated checks

Debian and Ubuntu install a daily cron job (/etc/cron.daily/aide) that mails the report to root. Make sure root’s mail reaches you. On RHEL-family systems, add a timer or cron job:

echo '0 4 * * * root /usr/sbin/aide --check | mail -s "AIDE report $(hostname)" [email protected]' | sudo tee /etc/cron.d/aide-check

Or use a systemd timer with nice and ionice, since AIDE reads a lot of files. See systemd timers.

After legitimate changes: update the database

Package upgrades and config edits change files. Review the report, and if every change is expected, accept them:

sudo aide --update                                   # writes aide.db.new
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz   # RHEL naming
# Debian/Ubuntu: sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

A good routine: run updates, then aide --check, verify that the changes match the upgraded packages, then update the database. Verify package files independently with dpkg -V or rpm -Va.

Tune what’s monitored

Configuration is in /etc/aide/aide.conf and /etc/aide/aide.conf.d/ (Debian/Ubuntu), or /etc/aide.conf (RHEL). Rules pair paths with attribute groups:

# monitor content and permissions of system binaries and configs
/usr/bin   CONTENT_EX
/usr/sbin  CONTENT_EX
/etc       CONTENT_EX

# web application code (alert on new or changed PHP files)
/var/www/example.com/public  CONTENT_EX

# ignore noisy paths
!/var/log
!/var/cache
!/var/lib/php/sessions
!/var/www/example.com/public/wp-content/uploads
!/var/www/example.com/public/wp-content/cache

Monitoring application code is valuable for websites. A new .php file in a theme directory is a classic sign of a web shell. Exclude upload, cache and session directories that change constantly, or the reports become useless.

Protect the baseline

If an attacker can update the AIDE database, they can hide their changes. Keep a copy of the database off the server (and the config), and compare checksums occasionally:

sha256sum /var/lib/aide/aide.db*

For stronger guarantees, run checks against a read-only copy of the database, or run AIDE from trusted media.

AIDE vs other tools

Tool Approach
AIDE Periodic scan against a baseline. Lightweight
auditd Real-time logging of who changed what. See auditd
rkhunter Rootkit signatures plus a baseline of key binaries. See rkhunter
Wazuh / OSSEC Agent-based FIM, log analysis, central dashboard

AIDE says what changed. auditd says who changed it. They complement each other.

Quick reference

Task Command
Init (Debian/Ubuntu) aideinit
Init (RHEL) aide --init then move .new to the db
Check aide --check
Accept changes aide --update then move .new
Config /etc/aide/aide.conf / /etc/aide.conf
Exclude path !/path

Related: Lynis security audit and Linux server hardening.

  • Security
  • Linux
  • Hardening