AIDE (Advanced Intrusion Detection Environment) creates a baseline snapshot of your file system and alerts you to unauthorized changes — a valuable early-warning system for detecting compromise or unintended modification.
What File Integrity Monitoring Detects
Any unexpected modification to files you're monitoring — a modified system binary, an added backdoor script, or unauthorized configuration changes — often among the earliest detectable signs of a compromise, before more obvious symptoms appear.
Step 1 — Install AIDE
sudo apt install aide aide-common -yStep 2 — Review the Default Configuration
cat /etc/aide/aide.confDefines which directories/files are monitored and what attributes (permissions, size, checksums) are tracked for each.
Step 3 — Customize Monitoring Rules (Optional)
sudo nano /etc/aide/aide.conf.d/99_custom/var/www/myapp NORMALAdd specific paths relevant to your setup beyond the default system-focused monitoring, such as your application's code directory.
Step 4 — Initialize the Baseline Database
sudo aideinitCreates the initial snapshot that future checks compare against — run this on a known-clean system, ideally right after initial hardening, before any potential compromise could occur.
Step 5 — Activate the Database
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.dbStep 6 — Run a Manual Check
sudo aide --checkCompares the current file system state against the baseline, reporting any additions, deletions, or modifications.
Step 7 — Schedule Regular Automated Checks
sudo crontab -e0 3 * * * /usr/bin/aide --check | mail -s "AIDE Report: $(hostname)" [email protected]Interpreting AIDE Reports
Each report lists added, removed, and changed files — review these carefully; some changes are entirely expected (log files, package updates), while unexpected changes to system binaries or configuration warrant immediate investigation.
Updating the Baseline After Legitimate Changes
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.dbAfter legitimate system changes (package updates, intentional configuration changes), update the baseline so future reports don't repeatedly flag the same expected changes.
Reducing Noise: Excluding Frequently-Changing Paths
!/var/log
!/tmpExclude directories that legitimately change constantly and aren't security-critical to monitor at the file-integrity level, reducing report noise and making genuine anomalies easier to spot.
Protecting the AIDE Database Itself
If an attacker can modify the AIDE database itself, they could hide their changes from detection — consider storing the baseline database on read-only or separate storage, or at minimum restrict its permissions tightly.
Common Errors
Reports flood with expected changes — refine your monitored paths and exclusions to focus on genuinely security-relevant files (system binaries, configuration) rather than routinely-changing application data.
Continue Reading
- How to Detect and Respond to a Compromised VPS
- How to Monitor Auth Logs and Detect Intrusion Attempts on a Linux VPS
- How to Set Up Audit Logging for Compliance Requirements
Browse more articles in Server Security & Hardening.
