How to Set Up AIDE Intrusion Detection on Linux

AIDE creates a database of file checksums and alerts when files are modified unexpectedly — detecting malware injection and security breaches.

Install and Initialize

sudo apt install aide -y
sudo aide --init
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Configure

/etc NORMAL
/bin NORMAL
/var/www NORMAL
!/var/log
!/tmp

Run Check

sudo aide --check

Automate Weekly

#!/bin/bash
REPORT=$(sudo aide --check 2>&1)
CHANGES=$(echo "$REPORT" | grep -c "changed\|added\|removed")
if [ $CHANGES -gt 0 ]; then
    echo "$REPORT" | mail -s "AIDE: $CHANGES changes on $(hostname)" [email protected]
fi

Conclusion

AIDE detects intrusions that other tools miss. Our team implements comprehensive intrusion detection.