AIDE integrity

aide --check

Verifies the integrity of system files with AIDE, detecting unauthorized changes against the reference database.

Run it when you need file integrity monitoring: AIDE (Advanced Intrusion Detection Environment) generates a database with hashes and attributes of configured files (system binaries, critical config files) and --check compares it, reporting changes — modified, added, deleted. It's the reference FIM for Linux: detecting binary tampering (a backdoored ls), touched config files, and new files in critical directories. In hardening and IR, AIDE is the integrity layer: an unauthorized change to a system binary is the sign of compromise.

Don't use it without an updated database: AIDE compares against the database generated at installation — legitimate changes (system updates) trigger false positives until the database is regenerated (aide --init); regeneration after each maintenance is part of the flow. Coverage depends on configuration (aide.conf): unconfigured directories are not monitored. And beware: AIDE detects changes after the fact (in --check) — it doesn't prevent tampering; and an attacker with root can regenerate the database or delete it along with logs. For real-time detection, use auditd or SIEM FIM; AIDE is for periodic checks.