Introduction
In a production Linux environment, knowing if and when critical system files have been modified is paramount to detecting a compromise. The Advanced Intrusion Detection Environment (AIDE) is a powerful, open-source Host-based Intrusion Detection System (HIDS). It works by creating a database of file hashes, permissions, and metadata, and then periodically comparing the live file system against this database to detect unauthorized alterations. This guide demonstrates how to install and configure AIDE on a Linux server.
Prerequisites
You require a Linux server (e.g., Ubuntu, Debian, RHEL, or AlmaLinux) and an account with root or sudo privileges. Because AIDE reads sensitive system files, all commands must be run as root.
Step 1: Install AIDE
On Debian/Ubuntu-based systems, install the package using apt:
sudo apt update && sudo apt install aide
During the installation on Debian/Ubuntu, you may be prompted to configure Postfix if you want AIDE to email you daily reports. You can select “Local only” for now. On RHEL/CentOS-based systems, use dnf:
sudo dnf install aide
Step 2: Initialize the Database
Before AIDE can detect changes, it must take a snapshot of the current, “clean” file system. Run the initialization command:
sudo aideinit
(Note: On RHEL/AlmaLinux, the command is sudo aide --init). This process computes cryptographic hashes for thousands of files and may take several minutes depending on disk speed and system size.
Step 3: Move the Database to the Correct Location
AIDE initializes the database as a “new” file to prevent accidentally overwriting an active database. You must copy or rename it to make it the active baseline.
On Debian/Ubuntu:
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
On RHEL/AlmaLinux:
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
Security Note: In a highly secure environment, you should copy this aide.db file to a read-only medium or an offsite server immediately after initialization. If an attacker gains root access, they could alter the AIDE database to hide their tracks.
Step 4: Run a Manual Integrity Check
To verify the system against your baseline database, run the check command:
sudo aide --check
AIDE will scan the defined directories and compare them to the database. If no changes have occurred, it will report a clean run. To test it, you can create a dummy user using sudo adduser testuser, which alters /etc/passwd and /etc/shadow, and run the check again. AIDE will immediately flag these files as modified.
Step 5: Updating the Database
When you perform legitimate administrative tasks, such as running system updates (apt upgrade) or changing configurations, AIDE will flag these as changes. After verifying that the changes were authorized by you, you must update the database:
sudo aide --update
This generates a new database file (aide.db.new) containing the updated hashes. You must then repeat Step 3 to overwrite the old baseline with the new one.