Securing your domain and configuring DNS is only the first phase of deploying web operations. Once your domain is pointed to a host, securing the underlying operating system is critical to protecting your applications and users.

In this systems note, we examine AIDE (Advanced Intrusion Detection Environment), a powerful open-source tool designed to monitor host file integrity and detect unauthorized changes or covert compromises.

What is AIDE?

AIDE is a host-based intrusion detection tool that creates a snapshot database of your system’s files in a known-good state. It collates critical file attributes—including cryptographic checksums (md5, sha1, sha256), permissions, ownership, inode numbers, and modification times—and stores them in a verification database.

By periodically running verification checks, AIDE highlights any modified, added, or deleted files. This is invaluable for detecting compromised binaries (for example, if an attacker replaces a system command like /bin/ls or /bin/ps with a trojaned script designed to hide their activity).

[!IMPORTANT] Operational Best Practice: Ideally, you should compile and initialize AIDE on a fresh, clean operating system installation before connecting it to a public network. If a system is already compromised, AIDE will incorporate the malicious modifications into its baseline database as “known-good” attributes.

Furthermore, store the AIDE binary and its baseline database on write-protected or external media (such as a read-only USB key or a multi-session CD-R) to prevent an attacker from modifying the database to match their altered system files.

Step-by-Step Installation and Configuration

Follow these steps to compile, configure, and initialize AIDE on your server.

1. Download and Extract

Obtain the latest archive from the official AIDE repository, move it to a dedicated compilation directory, and unpack it:

tar xzf aide-*.tar.gz
cd aide-*/

2. Configure Compilation

Configure the build system. To keep the binary and configuration isolated from the host operating system, you can direct the installation prefix to your mounted external media (e.g., a secure USB key mounted at /mnt/usbkey):

./configure --prefix=/mnt/usbkey/aide --exec-prefix=/mnt/usbkey/aide
make
make install

3. Initialize the Configuration

Navigate to your AIDE installation directory and create an etc/ folder to store your rules and configuration:

cd /mnt/usbkey/aide
mkdir etc
cd etc
touch aide.conf

Open aide.conf in a text editor to define your integrity rules. The configuration syntax relies on two columns: the target directories/files on the left, and the rules/attributes to monitor on the right.

Here is a baseline configuration example:

# Define custom rule groups
MyRules = p+i+n+u+g+s+m+c+md5+sha256

# Monitor critical system directories
/bin            MyRules
/sbin           MyRules
/usr/bin        MyRules
/usr/sbin       MyRules
/etc            MyRules
/var/log        p+u+g # Monitor only permissions/owner for logs (size/checksum change frequently)

4. Database Initialization

Once your configuration rules are defined, initialize the baseline snapshot database:

/mnt/usbkey/aide/bin/aide --init

AIDE will scan the specified files and generate a new baseline file, typically named aide.new.db in your configuration directory. To activate it as the target baseline for future checks, rename it:

mv /mnt/usbkey/aide/etc/aide.new.db /mnt/usbkey/aide/etc/aide.db

5. Running Routine Integrity Checks

To verify the system’s integrity, run AIDE with the check command. This compares the live filesystem against the baseline database:

/mnt/usbkey/aide/bin/aide --check

Review the resulting output report. Any modified, added, or deleted files will be listed, allowing you to quickly isolate unauthorized activity on your server host.