AIDE (Advanced Intrusion Detection Environment) is an integrity checker used to detect authorized and unauthorized changes to a system. It is a host intrusion detection system that works by creating a baseline of the system and producing alerts based on comparing the current system state to the baseline. AIDE can help identify tampering, intrusions, and even accidental modifications to files on a system. Below, we will walk through setting up AIDE and testing it by modifying a simple file.

Learning Objectives

Prerequisites

• Create a Kali Linux VM

Deliverables

• Configuration File
• Baseline scan
• Scan after a file change
• Scan after file deletion

Resources

• AIDE Documentation
• VIM Documentation

Contributors and Testers

• Alec Parish

1. Start a Kali Linux VM (GNS3 is not needed for this lab)
   
2. Open a terminal and update/upgrade your Kali Linux VM
   1. Update

      sudo apt update

   2. Upgrade

      sudo apt upgrade

3. Install AIDE by typing

   sudo apt install aide -y

1. Verify your desktop’s directory full path by typing

   echo $HOME/Desktop

2. The results will vary by user, but in this example, our path is /home/kali/Desktop
3. Edit the aide configuration file by typing the following in the terminal

   sudo vi /etc/aide/aide.conf

4. Place your cursor at the top of the page and remove all contents by typing (you will not see it being typed!)

   300dd

5. The configuration should look like this
   

   

6. Save the file and quit the VIM editor by hitting the Esc key and typing

   :wq

7. Double-check your configuration by typing

   sudo aide --config-check --config /etc/aide/aide.conf

8. If there are no errors, you will not receive a message. If there are any errors, resolve them before moving on

1. Open another terminal session
2. Type the following to create a file on the desktop (remember, your desktop path may be different than this example!)

   echo ‘blue kangaroos are fun!’ > /home/kali/desktop/Kangaroo.txt

3. You should see a new text file on the desktop
   

   

4. Return to the original terminal to initialize the database for a baseline by typing

   sudo aideinit

   NOTE: If you run this command multiple times, you may need to type Y to overwrite the old baseline.

5. This creates a new database file, typically located at /var/lib/aide/aide.db/new
6. Check for any changes on the desktop compared to our baseline

   sudo aide --config /etc/aide/aide.conf --check

7. You should see no change in the report
   

   

8. We will now change our kangaroo file
   1. Double-click on the kangaroo.txt file
   2. Capitalize the word “Kangaroos”
   3. Save the file
9. Run the check again
   

   

10. You can see that changes were detected. The report tells you that the file kangaroo.txt was changed
11. Delete the kangaroo file
    

    

12. Run the check again
    

    

13. You can see that AIDE detected the file deletion

Career Connection

File integrity monitoring is an essential security control used to detect unauthorized modifications that may indicate malware, insider threats, or system compromise. Systems administrators, cybersecurity analysts, and incident responders use tools such as AIDE to establish trusted baselines, monitor critical operating system files, and investigate unexpected changes before they develop into larger security incidents. The skills developed in this chapter reflect common enterprise security practices where continuous integrity monitoring supports compliance, incident response, and the long-term protection of critical systems.

End of LAB