Regarding host-based intrusion detection on Linux, not everything must be eBPF, cloud-native, or backed by a dashboard with a 12-step install guide.
Sometimes, what you need is fast, simple, and hardened.
AIDE (Advanced Intrusion Detection Environment) is that tool.
Initially designed in the early 2000s and still actively maintained, AIDE remains one of the most trusted file integrity checkers on hardened Linux systems. It’s used in everything from air-gapped environments and critical infrastructure to high-assurance audit contexts where noise is not an option.
What Is AIDE?
AIDE is a host-based intrusion detection system (HIDS) that scans and maintains a snapshot of your filesystem, specifically, metadata like file permissions, checksums, timestamps, ownership, and size.
When run, it compares the system’s current state against its known-good database and reports any changes.
It’s minimal, non-resident (no daemon by default), and often used in combination with cron jobs or scheduled tasks to detect:
- Unauthorised changes to config files
- Rootkits or hidden binary replacements
- Unexpected modifications in system directories
Core Features
- Fast local file integrity checking
- Cryptographic hash support: SHA1, SHA256, SHA512, etc.
- Templated rule-based configuration
- Portable and simple to audit
- Outputs plaintext diffs or custom reports
- Doesn’t require an agent or network connection
Basic Installation
On Debian/Ubuntu:
sudo apt install aideOn Red Hat/CentOS:
sudo yum install aideBuild from source (if needed):
git clone https://github.com/aide/aide.git
cd aide
./configure && make && sudo make installHardened Use Cases
- Run AIDE via cron daily and email the results
- Store baseline hashes in an external location or an immutable store
- Pair with
auditdor a log monitoring system for broader HIDS coverage - Use in offline or classified environments with strict change control
Final Thoughts
If you’re looking for a simple, fast, and reliable file integrity checker that doesn’t require a backend, dashboard, or dozen dependencies, AIDE is still a top-tier choice, especially for:
- Servers with a tight attack surface
- Hardened security baselines
- Legacy or air-gapped systems
It’s not flashy. It’s not new. But it gets the job done—and in some environments, that matters.
You can download AIDE or read more here: https://github.com/aide/aide