Linux Security: Guide to AIDE File Integrity Monitoring

February 25, 2025 rootlogic linux security

File integrity monitoring is a critical component of a robust security strategy. It helps detect unauthorized changes to system files, which could indicate a breach or malicious activity. AIDE (Advanced Intrusion Detection Environment) is a powerful open-source tool that creates a database of file properties and can alert you when these properties change. This guide walks you through installing, configuring, and using AIDE on Linux systems to enhance your security posture.

Introduction

AIDE works by taking a snapshot of your system's file state, including file attributes such as permissions, inode information, modification times, and cryptographic hashes. It stores this information in a database, which serves as a baseline for future comparisons. When you run a check, AIDE compares the current state of files against this database and reports any differences that might indicate tampering or unauthorized changes.

This monitoring capability is essential for:

Detecting unauthorized file modifications
Identifying potential security breaches
Meeting compliance requirements (PCI-DSS, HIPAA, etc.)
Maintaining system integrity
Creating audit trails for forensic analysis

Step 1: Installing AIDE

AIDE is available in most Linux distribution repositories. Use your package manager to install it:

For Debian/Ubuntu based systems:

sudo apt update
sudo apt install aide

For Red Hat/CentOS based systems:

sudo yum install aide

For Fedora:

sudo dnf install aide

During installation on Debian-based systems, you might be prompted to initialize the AIDE database. You can choose "No" as we'll manually initialize it later.

Step 2: Understanding AIDE Configuration

AIDE's configuration file is typically located at /etc/aide/aide.conf (Debian/Ubuntu) or /etc/aide.conf (Red Hat/CentOS). This file controls which files AIDE monitors and what attributes it checks.

Let's examine the key components of the configuration file:

Database Definition

The configuration specifies where AIDE stores its database:

database=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new

Rule Definitions

Rules define which attributes AIDE checks for each file. Here are common rule groups:

# Basic file attributes
NORMAL = p+i+n+u+g+s+m+c+md5

# Everything but access time
ALLXTMP = p+i+n+u+g+s+m+c+md5+sha1

# Directories - don't bother with hashes
DIR = p+i+n+u+g

# Full check
EVERYTHING = p+i+n+u+g+s+m+c+md5+sha1+sha256+rmd160+tiger

The letters in the rules represent different file attributes:

p: permissions
i: inode
n: number of links
u: user
g: group
s: size
m: modification time
c: creation time
md5: MD5 checksum
sha1: SHA1 checksum

File Selection

The configuration includes which directories and files to monitor, using rules like:

/etc NORMAL
/bin NORMAL
/sbin NORMAL
/var/log LOGS

It also specifies what to exclude:

!/var/lib/aide
!/var/cache
!/var/tmp
!/tmp

Step 3: Customizing Your AIDE Configuration

Before initializing AIDE, you should customize the configuration to suit your needs. Let's create a custom configuration that balances comprehensive monitoring with performance:

sudo nano /etc/aide/aide.conf

Modify the file selection rules to match your security requirements. Here's a recommended setup:

# Core system binaries
/bin NORMAL
/sbin NORMAL
/usr/bin NORMAL
/usr/sbin NORMAL
/usr/local/bin NORMAL
/usr/local/sbin NORMAL

# Important configuration files
/etc NORMAL
/boot NORMAL

# Log files - check permissions but not content
/var/log DIR
!/var/log/.*

# Monitor user directories but not their contents
/home DIR
!/home/*/\..*
!/home/*/tmp

# Common exclusions to reduce false positives
!/var/spool/.*
!/var/run/.*
!/var/lock/.*
!/var/tmp/.*
!/tmp/.*
!/proc/.*
!/sys/.*
!/dev/.*

# Exclude AIDE's own files to prevent conflicts
!/var/lib/aide/.*

Save the file after making your changes.

Step 4: Initializing the AIDE Database

Now that you've configured AIDE, it's time to initialize the database. This creates a baseline of all monitored files:

For Debian/Ubuntu:

sudo aideinit

This command runs aide --init behind the scenes and then copies the new database to the correct location.

For Red Hat/CentOS:

sudo aide --init
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

The initialization process can take a while, depending on the number of files being monitored. AIDE will scan all the specified files and create a database with their current state.

Step 5: Running Your First AIDE Check

After initializing the database, you can run your first integrity check to verify everything is working:

sudo aide --check

Since you just created the database, there should be no changes reported unless something was modified during the initialization process.

The output will look something like this if no changes are found:

AIDE found NO differences between database and filesystem. Looks okay!

Step 6: Creating a Test Change

To verify AIDE is properly detecting changes, let's create a test modification:

sudo touch /etc/test-file
echo "This is a test" | sudo tee /etc/test-file

Now run AIDE again:

sudo aide --check

You should see output indicating that a new file was added to the monitored directory:

AIDE found differences between database and filesystem!!

File added: /etc/test-file

Summary:
  Total number of files:    12345
  Added files:              1
  Removed files:            0
  Changed files:            0

Step 7: Updating the AIDE Database

After making legitimate changes to your system (such as installing updates or changing configurations), you'll want to update the AIDE database to prevent false positives:

For Debian/Ubuntu:

sudo aide --update

This creates a new database that you need to move into place:

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

For Red Hat/CentOS:

sudo aide --update
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Step 8: Automating AIDE with Cron

To make AIDE truly effective, you should run it regularly. Let's set up a daily cron job to run checks and email the results:

sudo nano /etc/cron.daily/aide-check

Add the following content to the file:

#!/bin/bash

# Path to the aide binary
AIDE_BIN=/usr/bin/aide

# Path to the report file
REPORT_FILE=/var/log/aide/aide-$(date +%Y%m%d).log

# Email address to send reports to
EMAIL="root@localhost"

# Create log directory if it doesn't exist
mkdir -p /var/log/aide

# Run the check and save output
$AIDE_BIN --check > $REPORT_FILE 2>&1

# Check if there were changes
if grep -q "found differences" $REPORT_FILE; then
    # Send email alert if changes were found
    cat $REPORT_FILE | mail -s "AIDE detected changes on $(hostname)" $EMAIL
fi

exit 0

Make the script executable:

sudo chmod +x /etc/cron.daily/aide-check

Ensure you have a mail transport agent installed to send emails:

sudo apt install postfix mailutils  # For Debian/Ubuntu
# or
sudo yum install postfix mailx      # For Red Hat/CentOS

Step 9: Advanced AIDE Configuration

Macros for Different File Types

You can create custom macros for different types of files:

# Configuration files - watch content and attributes
CONFIGFILES = p+i+n+u+g+s+m+c+md5+sha1

# Logs - only watch permissions, not content
LOGFILES = p+i+n+u+g

# Binaries - use stronger hashes
BINARIES = p+i+n+u+g+s+m+c+md5+sha1+sha256

# Apply these macros
/etc CONFIGFILES
/var/log LOGFILES
/bin BINARIES
/sbin BINARIES

Setting Up Email Notifications

If you prefer direct email notifications from AIDE, you can configure this in the configuration file:

report_url=stdout
report_url=mail:root@localhost

Troubleshooting Section

Common Issues and Solutions

1. Database Initialization Errors

Problem: AIDE fails during initialization with "unable to create database" errors.

Solution: Check directory permissions:

sudo mkdir -p /var/lib/aide
sudo chmod 700 /var/lib/aide
sudo aide --init

2. Too Many False Positives

Problem: AIDE reports too many changes during normal operation.

Solution: Refine your exclude patterns:

# Add to configuration file
!/var/log/.*\.log
!/var/log/.*\.gz
!/var/log/btmp.*
!/var/log/wtmp.*

3. High CPU or Disk Usage

Problem: AIDE scans consume too many resources.

Solution: Limit the rule complexity for large directories:

# Use simpler checks for large directories
/var p+i+n+u+g
/usr/share p+i+n+u+g

4. Handling Legitimate Changes

Problem: Frequent legitimate changes cause constant alerts.

Solution: Create an update script to run after system updates:

#!/bin/bash
# Run after system updates
sudo aide --update
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Best Practices & Optimization Tips

Security Enhancements

Store database off-system: For maximum security, keep a copy of the AIDE database on a read-only medium or separate server
Use strong hashes: Configure AIDE to use SHA-256 or SHA-512 instead of MD5 for more secure file verification
Protect the configuration: Restrict access to the AIDE configuration file to prevent tampering
Verify binary integrity: Before running AIDE, verify its binary hasn't been compromised using checksums

Performance Optimization

Selective monitoring: Only monitor critical system files to reduce resource usage
Schedule during off-hours: Run AIDE checks during periods of low system activity
Use appropriate rule levels: Don't use heavy cryptographic checks for directories that change frequently
Incremental updates: Consider using AIDE's incremental update feature for large filesystems

Integration with Other Security Tools

AIDE works well as part of a broader security strategy. Consider integrating it with:

Security Information and Event Management (SIEM)

Forward AIDE reports to a central logging system:

# Add to your aide-check script
logger -t aide -p auth.notice "AIDE check completed with $(grep -c 'changed' $REPORT_FILE) changes detected"

Configuration Management Systems

Use Ansible, Puppet, or Chef to manage AIDE across multiple systems:

# Example Ansible task
- name: Install and configure AIDE
  package:
    name: aide
    state: present

- name: Copy AIDE configuration
  template:
    src: aide.conf.j2
    dest: /etc/aide/aide.conf
    owner: root
    group: root
    mode: '0600'

- name: Initialize AIDE database
  command: aide --init
  args:
    creates: /var/lib/aide/aide.db

Conclusion

AIDE is a powerful tool for file integrity monitoring that forms an essential layer in your Linux security strategy. By properly configuring and automating AIDE, you can detect unauthorized changes to critical system files and respond quickly to potential security incidents.

Regular AIDE checks, combined with proper update procedures after legitimate system changes, provide continuous assurance that your system remains in its expected state. This monitoring capability is invaluable for both security compliance and peace of mind.

Remember that file integrity monitoring is just one component of a comprehensive security approach. For maximum effectiveness, combine AIDE with other security tools such as intrusion detection systems, regular security updates, and robust access controls.