L15. File Integrity Monitoring with AIDE

What Is File Integrity Monitoring?

File Integrity Monitoring (FIM) is a security control that detects unauthorized changes to files on your system. It works by:

1. Creating a database (baseline) of cryptographic hashes for monitored files
2. Periodically scanning those files and comparing their current hashes to the baseline
3. Reporting any files that have been added, modified, or deleted

FIM answers a critical question: has anything changed that should not have changed?

Why FIM Matters

Attackers often modify system files to maintain access or hide their presence:

• Replacing /usr/bin/ssh with a trojaned version that captures passwords
• Adding a backdoor user to /etc/passwd
• Modifying /etc/crontab to run a reverse shell on a schedule
• Altering log files to remove evidence

Without FIM, these changes can go undetected for months. FIM is a requirement in several compliance frameworks including PCI DSS (Requirement 11.5) and is a recommended control in CIS benchmarks.

Introduction to AIDE

AIDE (Advanced Intrusion Detection Environment) is an open-source FIM tool that is available on all major Linux distributions. It is lightweight, file-based, and straightforward to configure.

Installing AIDE

# Debian/Ubuntu
sudo apt install aide
# RHEL/CentOS
sudo dnf install aide

Configuring AIDE

AIDE's configuration file defines which directories to monitor and which file attributes to track:

# View the config (location varies by distribution)
cat /etc/aide/aide.conf        # Debian/Ubuntu
cat /etc/aide.conf             # RHEL/CentOS

Configuration Syntax

# Define a rule set for what attributes to check
NORMAL = p+i+n+u+g+s+m+c+md5+sha256
# Monitor directories using the rule set
/etc    NORMAL
/bin    NORMAL
/sbin   NORMAL
/usr/bin  NORMAL
/usr/sbin NORMAL
# Exclude directories that change frequently
!/var/log
!/var/cache
!/tmp

The attribute flags specify what AIDE tracks for each file:

Initializing the Database

Before AIDE can detect changes, it needs a baseline:

# Generate the initial database
sudo aideinit                   # Debian/Ubuntu
# Or manually on RHEL/CentOS
sudo aide --init

This process can take several minutes as AIDE hashes every monitored file. Once complete, you need to activate the database:

# Debian/Ubuntu (aideinit handles this automatically)
# RHEL/CentOS: move the new database into place
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Important: Initialize the database on a known-clean system. If the system is already compromised, the baseline will include the attacker's modifications.

Running Integrity Checks

# Run a check comparing current state to the baseline
sudo aide --check

Understanding the Output

AIDE reports three categories of changes:

Added entries:
  f++++++++++: /etc/cron.d/suspicious-job
Changed entries:
  f   ...C..S : /etc/passwd
  f   ...C..S : /usr/bin/ssh
Removed entries:
  f-----------: /usr/bin/legitimate-tool

Each letter in the change summary indicates which attribute changed. When /etc/passwd shows changes to content (C) and size (S), someone has modified the file.

Updating the Baseline

After you make legitimate changes (installing packages, updating configurations), you need to update the baseline so those changes are not flagged again:

# Update the database to reflect current state
sudo aide --update
# Move the new database into place
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Only update the baseline after verifying that the changes are legitimate. Blindly updating after every alert defeats the purpose of FIM.

Scheduling Automated Scans with Cron

Manual checks are useful, but automated daily scans catch changes that might otherwise go unnoticed:

# Add a cron job for a daily AIDE check at 3 AM
sudo crontab -e
# Add this line:
0 3 * * * /usr/bin/aide --check | mail -s "AIDE Report" admin@example.com

On systems without a mail relay, you can write the output to a file:

0 3 * * * /usr/bin/aide --check > /var/log/aide/daily-check-$(date +\%Y\%m\%d).log 2>&1

Alternatives to AIDE

AIDE is not the only FIM tool available:

For a single server, AIDE is often sufficient. For a fleet of servers, a centralized solution like Wazuh provides better visibility and alerting.

Best Practices

• Initialize the baseline immediately after hardening a fresh install
• Store a copy of the baseline database offline or on a separate system
• Review alerts before updating the baseline: never update blindly
• Exclude directories that change frequently (/var/log, /tmp, /var/cache) to reduce noise
• Combine FIM with auditd for both periodic snapshots and real-time kernel-level monitoring