AIDE (Advanced Intrusion Detection environment) is a great approach to layered security on a Linux Server. This covers a basic install and configuration to run once per day with a report to your email account(or not).
It is recommended to run this on a “Clean” system – i.e one that is perhaps freshly installed and configured before deployment on the web.
Any updates to software or system on the server after this point will trigger false positives, so be sure to update the database after any such work is done.
0. Log in as root
1. Install the package
yum install aide
2. Edit the config file to be able to send to your email address
NOTE: If you do not wish to receive a daily report or you want to inspect the logs manually, skip this section ang go to step 3.
look for the following lines and comment out via # at the beginning of the line
it should now read:
add the following lines immediately below the commented out section as mentioned above:
save and exit /etc/aide.conf
3. Run AIDE to create the initial database
Steps 3 and 4 will need to be repeated each time you do a system update or modify any configuration files, so be warned. Security and convenience are mutually exclusive.
4. Copy the database to default setting – this is the baseline database.
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
5. Run the AIDE first check
Expected output in a perfect world:
AIDE, version 0.13.1
### All files match AIDE database. Looks okay!
6. Setup a daily job (in this case to run at 11pm) to run
if you wish to receive the email as configured in step 2, add to end of file
00 23 * * * /usr/sbin/aide –check /bin/mail -s “$HOSTNAME – Daily AIDE integrity check” firstname.lastname@example.org
if you do not wish to receive any email modify the crontab as indicated below
00 20 * * * /usr/sbin/aide –check
the default logs can be accessed at:
There will be a list of modified files and or filesystem.
Further information on AIDE as well as troubleshooting can be found here: http://www.cs.tut.fi/~rammer/aide/manual.html