While tools like Rootkit Hunter actively scan your system for known malware signatures and hidden backdoors, a truly secure server also requires a "tripwire" system. If an advanced attacker manages to bypass your outer defenses and modify a core system file, inject malicious code into a web script, or subtly alter an application binary, you need to know immediately.

Advanced Intrusion Detection Environment (AIDE) is a powerful File Integrity Monitoring (FIM) tool. It creates a cryptographic snapshot of your entire server and continuously compares your live files against this secure baseline, immediately alerting you to any unauthorized modifications.

How AIDE Protects Your Server

AIDE relies on strict cryptographic hashing (such as SHA-256 or SHA-512) rather than just looking at file modification dates, which attackers can easily spoof.

During its initial setup, AIDE scans the directories you specify and records the hash, permissions, ownership, and size of every single file into a secure database. When a routine check is run, it recalculates the hashes of your live system files. If an attacker has added a hidden webshell to your /var/www directory, or modified the /etc/passwd file to create a backdoor user, the new hash will not match the baseline, and AIDE will trigger a critical alert.

Installing and Initializing the Baseline

Installing AIDE must be done on a known-clean server. If you install it on a system that is already compromised, you will end up creating a "trusted" baseline of the attacker's malicious files.

• Connect to your VPS via SSH as a user with sudo privileges.

• Update your package lists and install the tool by running: sudo apt update && sudo apt install aide.

• Generate the initial secure baseline by executing: sudo aideinit.

• Depending on the size of your server's storage, this process can take anywhere from a few minutes to half an hour as it calculates hashes for tens of thousands of files.

• Once initialization is complete, AIDE creates a "new" database file. You must explicitly activate it by overwriting the default database. On Ubuntu/Debian, copy the new file into the active path: sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Customizing the Monitoring Rules

Out of the box, AIDE is configured to monitor critical system directories like /bin, /sbin, and /etc. However, you should customize its configuration to also protect your specific application data, while ignoring rapidly changing directories like cache or log folders to prevent false alarms.

• Open the main configuration file with your text editor: sudo nano /etc/aide/aide.conf.

• You will see rule definitions (like FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256) that dictate exactly what attributes are checked.

• To add your custom web directory to the strict monitoring list, scroll to the directory section and add a line like: /var/www/mywebsite/ NORMAL

• To strictly ignore a directory that changes constantly (so it doesn't trigger false positives every day), use an exclamation mark: !/var/www/mywebsite/cache/

Running Routine Checks and Updating the Database

To actively detect intrusions, you need to command AIDE to compare the live system against the database you generated.

• Execute a manual integrity check by running: sudo aide --check.

• The tool will output a detailed report listing any files that have been created, modified, or deleted since the baseline was established.

• Crucial Step: When you perform legitimate administrative tasks—such as running apt upgrade to patch your server or deploying new code to your website—AIDE will flag these as modifications. After verifying that the changes were your own, you must update the database to reflect the new healthy state: sudo aide --update

• Always remember to copy the newly generated database over the active one after a legitimate update: sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

By default, the Ubuntu/Debian installation of AIDE automatically adds a daily cron job (/etc/cron.daily/aide) that runs the --check command and emails the root user the report. Ensuring this report goes to an actively monitored inbox is critical for rapid incident respons