What Is AIDE in Linux and How Does It Work?

The Advanced Intrusion Detection Environment (AIDE) is an open-source host-based intrusion detection system (HIDS) primarily used for file integrity monitoring (FIM) in Linux operating systems. This article explains the role of AIDE in Linux security, details how it creates and utilizes baseline cryptographic databases to detect unauthorized file system changes, highlights the specific file attributes it monitors, and outlines why it is a critical component for system auditing and regulatory compliance.

Understanding AIDE and File Integrity Monitoring

AIDE serves as a replacement for the classic Tripwire tool. Its primary role in Linux is to monitor the integrity of critical system files, binaries, and configurations to detect unauthorized modifications, deletions, or additions.

While firewalls and network intrusion detection systems safeguard the perimeter, AIDE operates internally at the host level. It alerts system administrators if a malicious actor, unauthorized user, or rogue process successfully bypasses external defenses and alters core operating system files.

How AIDE Works

AIDE relies on a comparison model that evaluates the current state of a file system against a trusted baseline. Its operation consists of three main phases:

1. Baseline Database Initialization

During initial configuration, an administrator defines rules in /etc/aide.conf specifying which directories and files to monitor, as well as which attributes to track. AIDE scans these target files and records their characteristics into a trusted database (typically stored as aide.db.gz).

2. Integrity Verification

At scheduled intervals—often automated via cron jobs or systemd timers—AIDE scans the system again. It generates fresh cryptographic hashes and metadata for the targeted files and compares them against the stored baseline database.

3. Reporting Discrepancies

If any discrepancy exists between the baseline and the current state, AIDE outputs a detailed report detailing whether files were added, deleted, or altered. The administrator can then determine if the change was legitimate (such as an authorized package update) or indicative of a compromise.

Monitored File Attributes

AIDE can monitor an extensive list of file characteristics beyond basic content changes:

• Cryptographic Hashes: Checks file content integrity using algorithms like SHA-256, SHA-512, and MD5.
• File Permissions and Access Control: Monitors changes to read, write, and execute permissions, including POSIX ACLs.
• Ownership: Tracks modifications to user and group ownership (UID/GID).
• Timestamps: Detects alterations to file modification time (mtime), change time (ctime), and access time (atime).
• Inode Data: Watches inode numbers and hard link counts.
• File Size: Flags increases or decreases in file size.
• Extended Attributes and SELinux Contexts: Verifies security contexts to ensure mandatory access controls remain uncompromised.

Key Use Cases in Linux Environments

• Rootkit and Backdoor Detection: Attackers often replace common binaries (such as ls, ps, or sshd) with trojanized versions to hide their presence. AIDE immediately flags modifications to these critical system binaries.
• Configuration Drift Auditing: It identifies unintentional or unapproved changes to core configuration files in /etc, helping maintain standardized server configurations.
• Regulatory and Standards Compliance: Frameworks such as PCI-DSS, ISO/IEC 27001, and CIS Benchmarks require file integrity monitoring to ensure that sensitive log files and configuration states remain immutable and auditable.

Basic Management Commands

Managing AIDE involves three essential commands:

• aide --init: Generates the initial baseline database (aide.db.new.gz), which must then be renamed to aide.db.gz to become the active baseline.
• aide --check: Scans the system against the active baseline and outputs any detected differences.
• aide --update: Performs an integrity check and automatically generates a new baseline database reflecting legitimate system updates.