Hjälpcentral

AIDE (Advanced Intrusion Detection Environment) creates a database of file checksums and attributes, then alerts you to any unexpected changes — a critical detection mechanism for catching unauthorized modifications, including those made by rootkits or attackers covering their tracks.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access

Step 1 — Install AIDE

sudo apt update
sudo apt install aide aide-common -y

Step 2 — Initialize the Baseline Database

sudo aideinit

This scans the filesystem and creates a baseline database reflecting the current, presumably clean, state — do this immediately after hardening a fresh server, before it's exposed to potential compromise.

Step 3 — Activate the Database

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Step 4 — Run a Manual Check

sudo aide --check

Compares the current filesystem state against the baseline, reporting any additions, deletions, or modifications.

Understanding AIDE's Configuration

sudo nano /etc/aide/aide.conf

Defines which directories are monitored and what attributes are checked (permissions, size, checksums, timestamps).

Common Monitored Paths

/etc    NORMAL
/bin    NORMAL
/sbin   NORMAL
/usr/bin  NORMAL
/usr/sbin NORMAL

Excluding Frequently-Changing Directories

!/var/log
!/tmp
!/proc

Logs and temp files change constantly and legitimately — excluding them reduces false-positive noise significantly.

Scheduling Regular Checks

sudo crontab -e

0 5 * * * /usr/bin/aide --check | mail -s "AIDE Report: $(hostname)" [email protected]

Updating the Baseline After Legitimate Changes

After intentional system changes (software installation, configuration updates), update the baseline to avoid ongoing false alerts:

sudo aide --update
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Protecting the AIDE Database Itself

If an attacker can modify the AIDE database itself, they can hide their changes. For meaningful protection:

• Store a copy of the baseline database off-server, in a location the attacker couldn't reach even with full root access to this VPS
• Consider storing it on read-only media if feasible for your setup

Interpreting AIDE Reports

Common Errors

Overwhelming number of false-positive alerts — refine the exclusion list in aide.conf to skip directories that legitimately change often.

Check takes a long time to run — normal for a full filesystem scan on larger disks; consider scheduling during low-activity hours.

Best Practices

• Initialize the baseline on a known-clean, freshly hardened server
• Store a copy of the baseline database off-server for tamper resistance
• Update the baseline promptly after legitimate changes to avoid alert fatigue

Continue Reading

• How to Detect and Remove Rootkits on a Linux VPS
• How to Install and Configure auditd for System Auditing
• How to Conduct a Security Audit of Your VPS

Browse more articles in Advanced Security & Compliance.