AIDE (Advanced Intrusion Detection Environment) creates a database of file checksums and attributes, then alerts you to any unexpected changes — a critical detection mechanism for catching unauthorized modifications, including those made by rootkits or attackers covering their tracks.
Prerequisites
- Ubuntu 22.04/24.04 or Debian 11/12 VPS
- Root or sudo access
Step 1 — Install AIDE
sudo apt update
sudo apt install aide aide-common -yStep 2 — Initialize the Baseline Database
sudo aideinitThis scans the filesystem and creates a baseline database reflecting the current, presumably clean, state — do this immediately after hardening a fresh server, before it's exposed to potential compromise.
Step 3 — Activate the Database
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.dbStep 4 — Run a Manual Check
sudo aide --checkCompares the current filesystem state against the baseline, reporting any additions, deletions, or modifications.
Understanding AIDE's Configuration
sudo nano /etc/aide/aide.confDefines which directories are monitored and what attributes are checked (permissions, size, checksums, timestamps).
Common Monitored Paths
/etc NORMAL
/bin NORMAL
/sbin NORMAL
/usr/bin NORMAL
/usr/sbin NORMALExcluding Frequently-Changing Directories
!/var/log
!/tmp
!/procLogs and temp files change constantly and legitimately — excluding them reduces false-positive noise significantly.
Scheduling Regular Checks
sudo crontab -e0 5 * * * /usr/bin/aide --check | mail -s "AIDE Report: $(hostname)" [email protected]Updating the Baseline After Legitimate Changes
After intentional system changes (software installation, configuration updates), update the baseline to avoid ongoing false alerts:
sudo aide --update
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.dbProtecting the AIDE Database Itself
If an attacker can modify the AIDE database itself, they can hide their changes. For meaningful protection:
- Store a copy of the baseline database off-server, in a location the attacker couldn't reach even with full root access to this VPS
- Consider storing it on read-only media if feasible for your setup
Interpreting AIDE Reports
| Change Type | What to Investigate |
|---|---|
| Modified binary in /bin or /sbin | Potential rootkit or trojan; investigate immediately |
| New file in /etc | Verify it was an intentional configuration change |
| Changed permissions on a system file | Could indicate unauthorized privilege escalation attempt |
Common Errors
Overwhelming number of false-positive alerts — refine the exclusion list in aide.conf to skip directories that legitimately change often.
Check takes a long time to run — normal for a full filesystem scan on larger disks; consider scheduling during low-activity hours.
Best Practices
- Initialize the baseline on a known-clean, freshly hardened server
- Store a copy of the baseline database off-server for tamper resistance
- Update the baseline promptly after legitimate changes to avoid alert fatigue
Related Articles
- How to Detect and Remove Rootkits on a Linux VPS
- How to Install and Configure auditd for System Auditing
- How to Conduct a Security Audit of Your VPS
