What is AIDE?

Advanced Intrusion Detection Environment (AIDE) is a tool to compare changes within files or directories. The hashes will be stored in the local database on the first run. After that, it will be compared on each subsequent run. If the hash content is different from the that in database, it will be recorded in logs. What’s more, we could configure the report and email reminder as well.

Its working principle is analogous to using md5sum to calculate the MD5 hash of a file. Then, we could compare the value of MD5 to check whether the file changes or not.

Installing and configuring AIDE

Installing the software application

1
2
(undercloud) [stack@director ~]$ sudo -i
 [root@director ~]# yum install aide -y

Initialize the AIDE database

Because this is the first time for us to use aide command, it’s a good idea to check the manual.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
[root@director ~]# aide -h
Aide 0.16

Usage: aide [options] command

Commands:
  -i, --init  Initialize the database
  -C, --check  Check the database
  -u, --update  Check and update the database non-interactively
  -E, --compare  Compare two databases

Miscellaneous:
  -D, --config-check Test the configuration file
  -v, --version  Show version of AIDE and compilation options
  -h, --help  Show this help message

Options:
  -c [cfgfile] --config=[cfgfile] Get config options from [cfgfile]
  -l [REGEX] --limit=[REGEX]  Limit command to entries matching [REGEX]
  -B "OPTION" --before="OPTION" Before configuration file is read define OPTION
  -A "OPTION" --after="OPTION" After configuration file is read define OPTION
  -r [reporter] --report=[reporter] Write report output to [reporter] url
  -V[level] --verbose=[level] Set debug message level to [level]

After learning the usage of aide command, Let’s Initialize the database.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
[root@director ~]# aide --init


Start timestamp: 2025-05-22 02:55:18 -0400 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz

Number of entries: 146260

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new.gz
  MD5      : 6SBee41U474Po/3Ez0LbzA==
  SHA1     : gP2ufYflEIe+8fmGz4rjzsFvZZE=
  RMD160   : Ffeno7GgHw2m4T3nO8kBkzWEJvU=
  TIGER    : cZ4f60cWTM93LLhbnnd4UCi/Mb3wial/
  SHA256   : dA5mb3sOorYG6TNUYv6wx3AiACaOmjik
             pV5urYvvde0=
  SHA512   : F7A4C03VGO89VbCJRU8/twujPdQPfigc
             lKWaO7sGuIw4skAZnMg32uhA2xA4uZGB
             2yvAThbJjGvsv/z5xluuoQ==


End timestamp: 2025-05-22 03:06:00 -0400 (run time: 10m 42s)

Checking the database

Note: The default database generated by aide is called aide.db.new.gz. While, when we check the database, it will check the database called aide.db.gz. Therefore, it is necessary for us to modify the name of the initialized database.

1
2
3
4
[root@director ~]# aide --check
Couldn't open file /var/lib/aide/aide.db.gz for reading

[root@director ~]# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

After changing the name, Let’s check the database again!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
[root@director ~]# aide --check
Start timestamp: 2025-05-22 03:09:45 -0400 (AIDE 0.16)
AIDE found NO differences between database and filesystem. Looks okay!!

Number of entries: 146260

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz
  MD5      : 6SBee41U474Po/3Ez0LbzA==
  SHA1     : gP2ufYflEIe+8fmGz4rjzsFvZZE=
  RMD160   : Ffeno7GgHw2m4T3nO8kBkzWEJvU=
  TIGER    : cZ4f60cWTM93LLhbnnd4UCi/Mb3wial/
  SHA256   : dA5mb3sOorYG6TNUYv6wx3AiACaOmjik
             pV5urYvvde0=
  SHA512   : F7A4C03VGO89VbCJRU8/twujPdQPfigc
             lKWaO7sGuIw4skAZnMg32uhA2xA4uZGB
             2yvAThbJjGvsv/z5xluuoQ==


End timestamp: 2025-05-22 03:17:33 -0400 (run time: 7m 48s)

Lovely！ Everything is OKay!!!

Testing for creating and modifying files

The basic rule is defined in /etc/aide.conf, Please view the configuration.

1
[root@director aide]# cat /etc/aide.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 [root@director ~]# aide --check
Start timestamp: 2025-05-22 03:45:03 -0400 (AIDE 0.16)
AIDE found differences between database and filesystem!!

Summary:
  Total number of entries: 146260
  Added entries:  0
  Removed entries:  0
  Changed entries:  8

---------------------------------------------------
Changed entries:
---------------------------------------------------

f < ...    . ... : /var/log/boot.log
f < ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/system.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-1002.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42445.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42454.journal
f < ...    . ... : /var/log/openvswitch/ovs-vswitchd.log
f < ...    . ... : /var/log/openvswitch/ovsdb-server.log
f           C    : /var/spool/anacron/cron.daily

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /var/log/boot.log
  Size     : 20229                            | 0

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/system.journal
  Size     : 33554432                         | 8388608
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> 8itPerM | [1] user.crtime_usec <=> aNrhqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-1002.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> tA1SerM | [1] user.crtime_usec <=> fIPkqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42445.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> H8tRerM | [1] user.crtime_usec <=> ZWjjqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42454.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> 0RNRerM | [1] user.crtime_usec <=> ssXiqLQ
             1BgA=                            | 1BgA=

File: /var/log/openvswitch/ovs-vswitchd.log
  Size     : 9962                             | 95

File: /var/log/openvswitch/ovsdb-server.log
  Size     : 799                              | 95

File: /var/spool/anacron/cron.daily
  SHA512   : x31MHpzW9WWgozNuoqMPg1cHHVt0xQO8 | c3xpb2d16NpVt1cajv8PMqwjIx+Z8RCn
             EG9RnlH5Qb4esO1bFTsytUoD975FOL5t | VWXKX3+wg/Z/Td1oHm/jHmlO3A3HBXF3
             VKsfa01Fo4G65ZOPi7d+9A==         | Nb9nq+4ZK0/+9mx9vyeZDQ==


---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz
  MD5      : 6SBee41U474Po/3Ez0LbzA==
  SHA1     : gP2ufYflEIe+8fmGz4rjzsFvZZE=
  RMD160   : Ffeno7GgHw2m4T3nO8kBkzWEJvU=
  TIGER    : cZ4f60cWTM93LLhbnnd4UCi/Mb3wial/
  SHA256   : dA5mb3sOorYG6TNUYv6wx3AiACaOmjik
             pV5urYvvde0=
  SHA512   : F7A4C03VGO89VbCJRU8/twujPdQPfigc
             lKWaO7sGuIw4skAZnMg32uhA2xA4uZGB
             2yvAThbJjGvsv/z5xluuoQ==


End timestamp: 2025-05-22 03:46:29 -0400 (run time: 1m 26s)

Updating the database

If you confirm that the modification is legal and right, you could update the current status to the database.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
[root@director ~]# aide --update
Start timestamp: 2025-05-22 03:51:02 -0400 (AIDE 0.16)
AIDE found differences between database and filesystem!!
New AIDE database written to /var/lib/aide/aide.db.new.gz

Summary:
  Total number of entries: 146260
  Added entries:  0
  Removed entries:  0
  Changed entries:  8

---------------------------------------------------
Changed entries:
---------------------------------------------------

f < ...    . ... : /var/log/boot.log
f < ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/system.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-1002.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42445.journal
f = ...    . .X. : /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42454.journal
f < ...    . ... : /var/log/openvswitch/ovs-vswitchd.log
f < ...    . ... : /var/log/openvswitch/ovsdb-server.log
f           C    : /var/spool/anacron/cron.daily

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

File: /var/log/boot.log
  Size     : 20229                            | 0

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/system.journal
  Size     : 33554432                         | 8388608
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> 8itPerM | [1] user.crtime_usec <=> aNrhqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-1002.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> tA1SerM | [1] user.crtime_usec <=> fIPkqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42445.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> H8tRerM | [1] user.crtime_usec <=> ZWjjqLQ
             1BgA=                            | 1BgA=

File: /var/log/journal/f874df04639f474cb0a9881041f4f7d4/user-42454.journal
  XAttrs   : num=1                            | num=1
             [1] user.crtime_usec <=> 0RNRerM | [1] user.crtime_usec <=> ssXiqLQ
             1BgA=                            | 1BgA=

File: /var/log/openvswitch/ovs-vswitchd.log
  Size     : 9962                             | 95

File: /var/log/openvswitch/ovsdb-server.log
  Size     : 799                              | 95

File: /var/spool/anacron/cron.daily
  SHA512   : x31MHpzW9WWgozNuoqMPg1cHHVt0xQO8 | c3xpb2d16NpVt1cajv8PMqwjIx+Z8RCn
             EG9RnlH5Qb4esO1bFTsytUoD975FOL5t | VWXKX3+wg/Z/Td1oHm/jHmlO3A3HBXF3
             VKsfa01Fo4G65ZOPi7d+9A==         | Nb9nq+4ZK0/+9mx9vyeZDQ==


---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.gz
  MD5      : 6SBee41U474Po/3Ez0LbzA==
  SHA1     : gP2ufYflEIe+8fmGz4rjzsFvZZE=
  RMD160   : Ffeno7GgHw2m4T3nO8kBkzWEJvU=
  TIGER    : cZ4f60cWTM93LLhbnnd4UCi/Mb3wial/
  SHA256   : dA5mb3sOorYG6TNUYv6wx3AiACaOmjik
             pV5urYvvde0=
  SHA512   : F7A4C03VGO89VbCJRU8/twujPdQPfigc
             lKWaO7sGuIw4skAZnMg32uhA2xA4uZGB
             2yvAThbJjGvsv/z5xluuoQ==

/var/lib/aide/aide.db.new.gz
  MD5      : kRAvaLUIKffJjsIXOkGvBw==
  SHA1     : Lmaax9VyxEbBBxBetixpEmdWAmU=
  RMD160   : uNOWJnBJ6vuV9bMC/kNJT+7Tagg=
  TIGER    : 9s27LZvANGDyxzuNPsItCg+Jj2kVpW8/
  SHA256   : CfPQWplclKeJ/KgAmvn0sRY69VYup5nM
             lYXg/yz1+24=
  SHA512   : PeEcnnOWA8EeRWHpYJdpHdv3x0lmvrJD
             QC3FQlDjsKssmneR5R6gENVSKPQjjAcH
             o37gGmDLiXgEN0IOQZDKHQ==


End timestamp: 2025-05-22 03:52:27 -0400 (run time: 1m 25s)

And do not forget to rename the database!

1
2
[root@director ~]# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
mv: overwrite '/var/lib/aide/aide.db.gz'? y