File integrity monitoring on Linux with AIDE

What file integrity monitoring does

A file integrity monitor records hashes, permissions, owners, and timestamps for important files, then compares later scans to that baseline. Changes to /bin/ls, /etc/passwd, or a web root appear as added, removed, or changed entries. AIDE (Advanced Intrusion Detection Environment) is a free, widely packaged tool for this.

It does not prevent changes. It tells you about them, which is valuable for both intrusions and unrecorded administrative changes.

Build the baseline

Install aide, review the configuration that selects directories and attributes, and initialize the database. The new database is written as aide.db.new and must be copied to the active name before checks will use it.

Initialize on a known-good system, ideally right after build. A baseline taken after a compromise blesses the attacker’s changes.

Snippet

sudo apt install aide   # or dnf install aide
sudo aideinit           # Debian/Ubuntu wrapper
# RHEL: sudo aide --init && sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
sudo aide --check | head -40

Lab: detect a tampered binary

After initializing, change a monitored file: add a user, edit a file in /etc, and replace a copy of a binary in /usr/local/bin. Run aide --check. The report lists each change with the attributes that differ, such as SHA-256 and mtime.

After you approve legitimate changes, update the baseline with aide --update and move the new database into place. Schedule a daily check with a systemd timer and send the report to your log platform.

Snippet

sudo useradd aidetest
echo "# test" | sudo tee -a /etc/hosts
sudo aide --check | grep -E "^(f|d)|changed|added|removed" | head
sudo aide --update && sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Protect the baseline

If an attacker with root can edit the AIDE database, they can hide their changes. Copy the database and the aide binary to read-only media or another system after each update, and verify the database hash before each check.

Tune the rules so routine changes such as log files and package caches do not flood the report. A report nobody reads detects nothing.

Diagram

Baseline, check, approve, update

Baseline
Initialize on a clean system.
Command
```
sudo aideinit
```
Check
Run daily and send the report centrally.
Review
Match each change to a ticket or investigate.
Update
Approve changes, rebuild, and store a protected copy.

Check yourself

1. When should you create the first AIDE baseline?

2. Why protect the AIDE database off-host?

3. What happens if you monitor busy log directories?