Recommended Free Tools
AIDE (Advanced Intrusion Detection Environment) protects a Linux VPS by recording a baseline of selected files and then comparing later scans with that baseline. Installation alone is not enough: you must review the installed configuration, initialize a database from a known-clean system, place that database at the configured database_in path, run a check, and arrange for reports to reach someone who will investigate them.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers Debian and Ubuntu packages, RHEL 9-compatible systems, practical VPS monitoring scope, database activation, authorized change handling, scheduling, and verification.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat AIDE does on a VPS
AIDE is a file-integrity checker, not a network firewall, malware remover, or complete intrusion-response system. It hashes and records attributes of files selected by its configuration, then compares the live filesystem with the saved database. A difference can indicate an intrusion, an administrator change, a package upgrade, or an expected service deployment; AIDE cannot decide which explanation is correct.
The usable workflow has four states:
- Install: obtain the distribution package and its service files.
- Configure: decide which paths and file attributes matter and confirm the input and output database locations.
- Baseline: initialize a database after the VPS is known to be clean and activate the generated file.
- Operate: run checks on a schedule, investigate differences, and create a replacement baseline after approved maintenance.
A check performed before an initialized database is installed cannot provide a meaningful comparison. The Ubuntu AIDE manual states that you must initialize a database and move it to the place specified by database_in before using --check.
#1 Best Overall
Prerequisites and a clean starting point
Use an account with sudo access or a root shell. Record the distribution and release first, because package paths, rule syntax, and supplied schedules vary.
cat /etc/os-release
aide --versionIf AIDE is not installed, the second command will fail; run it again after installation. Before creating a baseline:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Finish planned operating-system, kernel, web-server, SSH, and application changes.
- Confirm that administrative access works through the method you intend to keep.
- Check that the VPS has enough free space for the database and scan reports.
- Make sure the system is in a state you would be willing to restore or investigate later. AIDE will faithfully baseline unwanted files if you initialize too early.
- Decide where the database and configuration will be backed up and who is responsible for reading alerts.
AIDE does not prove that a machine is clean. If compromise is suspected, investigate or rebuild from trusted media instead of treating a new baseline as a cure.
Install the package for your distribution
| Distribution family | Install command | Configuration and packaging details to verify |
|---|---|---|
| Debian or Ubuntu | sudo apt updatesudo apt install aide |
Common files include /etc/aide/aide.conf, /etc/default/aide, /var/lib/aide, and a daily /etc/cron.daily/aide job. The installer can prompt to initialize the database. Exact behavior differs by release. |
| RHEL 9 and compatible distributions | sudo dnf install aide |
Red Hat documentation uses /etc/aide.conf for configuration. Confirm the database path and whether a cron job or systemd timer was installed on the VPS. |
On Debian-family systems, let the package finish installing even if it offers initialization during the prompt. You should still inspect the resulting configuration and confirm the generated database location rather than assuming that the prompt used the policy you want. On any distribution, list the installed files and read the package documentation supplied with your release.
sudo find /etc -maxdepth 3 -iname '*aide*' -print
sudo find /var/lib -maxdepth 3 -iname '*aide*' -printDo not copy an old tutorial’s paths blindly. A release may use a different directory, include configuration fragments, or provide no automatic schedule.
Read and tailor aide.conf before initialization
aide.conf contains the runtime configuration used to initialize and check the AIDE database. It is case-sensitive and normally combines parameter lines, path-selection rules, exclusions, and macros. Debian-family packages can assemble the active configuration from /etc/aide/aide.conf.d through an update-aide.conf mechanism, so inspect both the main file and any included fragments.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Confirm the database parameters
Find the database_in and database_out lines in the active configuration. database_in is the baseline that --check reads. database_out is where --init or --update writes a newly generated database. They may use a distribution-specific directory and a filename such as aide.db or aide.db.new.
Rank #2
grep -nE '^[[:space:]]*database_(in|out)' /etc/aide/aide.conf 2>/dev/null
grep -nE '^[[:space:]]*database_(in|out)' /etc/aide.conf 2>/dev/nullUse the path from the configuration that the installed command actually loads. If the package supplies an alternative configuration or a wrapper script, follow that wrapper’s documented path.
Select a useful VPS scope
A broad default can produce noise from files that change constantly. Review rules for the parts of the VPS whose integrity matters:
- System configuration:
/etc, including SSH daemon settings, authentication policy, host keys, sudo policy, and service configuration. - Privileged executables: system binaries and administrative tools that an attacker could replace.
- Service definitions: systemd unit directories and other startup configuration used by the distribution.
- Scheduled execution: system and user cron directories and any application scheduler configuration.
- Web and application deployment: web-server configuration, document roots, deployment directories, and startup scripts that are part of your threat model.
Exclude volatile runtime state, caches, temporary files, mounted pseudo-filesystems, and other trees that change as a normal consequence of operation when your distribution’s rules do not already exclude them. Monitoring every transient file can bury a genuine alteration in routine changes. Conversely, do not exclude an application directory merely because it changes if unauthorized code there would be important.
Understand attributes and exclusions
Rules can select attributes such as ownership, mode, size, timestamps, and content checksums. Ubuntu’s current examples include groups named OwnerMode, StaticFile, and Full. Group definitions and available attributes differ by AIDE version, so treat the installed file as the syntax authority.
# Illustrative rule shape only; verify the groups and exclusions shipped by your release
/etc Full
!/etc/mtabThe example demonstrates the idea of selecting a tree and then excluding a volatile path; it is not a universal policy. Read comments in your file, check whether a path is already covered by a macro, and avoid defining overlapping rules that make the resulting report difficult to interpret.
Validate before creating the baseline
If your installed version supports it, parse the configuration explicitly:
sudo aide --config-checkFix every syntax, include-path, permission, or unknown-rule error before initialization. A successful parse does not confirm that your scope is appropriate; review the selected paths and exclusions separately.
Initialize and activate the AIDE database
Run initialization on the known-clean state
Once configuration review is complete, initialize the database:
sudo aide --initAIDE writes the new database to database_out. Packaging defaults commonly create a file called aide.db.new, but the directory and filename are release-dependent. Watch the command output for the exact destination and check that the file exists.
sudo find /var/lib/aide /var/lib -maxdepth 3 -type f -iname '*aide*' -ls 2>/dev/nullMove the generated file to database_in
Do not run the first check against an unactivated file. Review that initialization completed without errors, then move or rename the generated database to the exact location specified by database_in. A common Debian-family example is:
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.dbUse this command only when those are the paths shown by your installed configuration. If your output uses another directory or filename, substitute those values. Preserve a protected copy of the original baseline when your backup and incident-response procedures call for one, and restrict write access to trusted administrators.
Run the first comparison
sudo aide --checkThe first comparison should be quiet apart from normal command output if the filesystem has not changed since initialization. Read the complete report and note how your package communicates differences and exit status. Automation should treat the report and status according to the distribution’s documentation, not according to an assumption borrowed from another release.
Interpret changes instead of blindly replacing the baseline
AIDE reports differences; it does not label them malicious. For every changed path, identify the actor, change window, and reason. Package upgrades commonly replace binaries and libraries. Editing SSH policy, rotating host keys, renewing certificates, deploying application code, changing web-server configuration, and modifying scheduled jobs can all be legitimate while still requiring review.
Investigate an unexpected difference
- Check the file’s package ownership and installation history.
- Compare the change with your maintenance tickets, deployment logs, and configuration-management records.
- Check whether the path is writable by a service account or exposed through an application.
- Look for related changes in startup files, privileged binaries, authentication configuration, and scheduled tasks.
- If the explanation is not credible, isolate the VPS or follow your incident-response plan before making further changes.
Do not run an update merely to make a warning disappear. Replacing the baseline without understanding a difference removes the comparison point that could help explain an intrusion.
Create a replacement baseline after approved maintenance
After you have confirmed and documented an authorized change, generate a new database:
sudo aide --update--update writes a new database; it does not safely replace the old input database in place. Review the command output, identify the generated file, and move it into the database_in location using the workflow documented for your package. Keep the previous baseline until the new one has been reviewed and backed up. If a change was only temporary, restore the original file or configuration and verify that the next check returns to the expected state instead of updating around it.
Schedule checks and deliver reports
Debian and Ubuntu daily job
Debian-family packaging commonly installs /etc/cron.daily/aide. Ubuntu community guidance says this job runs daily and mails output to the account configured by MAILTO in /etc/default/aide. Confirm both files on your release:
sudo ls -l /etc/cron.daily/aide
sudo sed -n '1,200p' /etc/default/aideA local mailbox that nobody reads is not monitoring. Set the recipient and mail transport according to your operational environment, or change the job so output reaches a monitored logging or alerting destination. Do not assume that a successful cron invocation means an administrator received the report.
RHEL and other distributions
A RHEL 9-compatible VPS may provide a cron entry, a systemd timer, or neither. Inspect both mechanisms:
sudo systemctl list-timers --all | grep -i aide
sudo systemctl list-unit-files | grep -i aide
sudo find /etc/cron.d /etc/cron.daily /etc/cron.weekly -maxdepth 1 -type f -iname '*aide*' -print 2>/dev/nullIf a supported unit exists, enable the exact unit name supplied by your installation and verify its last and next run times. If no schedule is supplied, create one through your normal system-administration process with an explicit report destination, least-privilege execution policy, and documented ownership. Avoid creating a second schedule when the package already runs one.
Prove that delivery works
Trigger or wait for one scheduled run during a maintenance window, then inspect the scheduler’s result and the configured mailbox or log destination. Confirm that the job runs with the privileges required to read monitored paths, that its output is retained long enough to investigate, and that a non-clean result is visible to the person on call.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verification checklist for a production VPS
Use this checklist after installation and whenever you change the policy:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallaide --versionreports the installed version.- The active configuration parses successfully with
sudo aide --config-checkwhen that option is available. database_inpoints to the activated baseline, and that file is readable by the scheduled process.- The baseline was initialized after the VPS reached a known-clean state.
sudo aide --checkcompletes, and you understand what its report and exit status mean for your release.- A deliberate, documented test change in an authorized maintenance window is detected and then reverted. Choose a harmless file that is actually monitored; never test by damaging authentication or boot files.
- The recurring cron job or systemd timer exists, runs under the intended privilege, and sends a readable report.
- Database files and configuration are protected from unauthorized modification and included in the VPS backup or incident-response plan.
After a test, run another check to confirm that the reverted state matches the original baseline. Record the test result so a future operator knows that the alert path was exercised intentionally.
Troubleshooting common failures
| Symptom | Likely cause | Action |
|---|---|---|
--check says no database exists |
The database was never initialized, or the generated file was left at database_out instead of database_in. |
Read both parameters in the active configuration, run sudo aide --init if necessary, and move the generated file to the configured input path. |
| Initialization or check reports a configuration error | Case-sensitive syntax, an invalid macro, a missing include, or a rule copied from another AIDE version. | Run sudo aide --config-check if supported; inspect the reported line and compare it with the rules shipped by this release. |
| The first report contains thousands of changes | The baseline was created before planned updates finished, or volatile trees are included. | Do not update immediately. Separate authorized maintenance from unexplained changes, then revise exclusions and reinitialize only after the system is trusted. |
| A package upgrade creates expected alerts | Installed files legitimately changed. | Verify the package and maintenance record, save the report, run sudo aide --update, and activate the generated database through the documented move step. |
| The daily job exists but nobody sees reports | MAILTO points to an unread local mailbox, mail transport is not configured, or output is discarded. |
Check the job’s execution result and redirect output to a monitored mailbox or logging destination. |
| The scheduled scan cannot read files | The job lacks required privilege, or permissions on the database/configuration are wrong. | Run the command manually with the same service context, correct ownership and permissions through your normal hardening process, and avoid making the database world-writable. |
Keep AIDE useful over time
File-integrity monitoring is a maintenance process. Revisit the scope when you add a service, move an application, change deployment tooling, or alter SSH and authentication policy. A rule that was appropriate for a small web server may be noisy after logs, caches, and container mounts are introduced. Document every exclusion and its reason so a later administrator does not mistake a deliberate blind spot for complete coverage.
Protect the baseline as carefully as the files it represents. If an attacker can alter both the live filesystem and the database, the comparison can be neutralized. Limit write access, include the database and configuration in protected backups, and retain prior baselines when your incident-response plan requires historical comparison. Backups do not replace an offline or separately controlled copy, so follow the security controls available in your hosting environment.
Finally, assign ownership for each alert. AIDE becomes useful when every report is either correlated with an approved change or investigated as an incident. An unattended cron file and an unread mailbox create the appearance of detection without providing a response capability.
Free tools Windows power users keep installed
One-click scans. No signup required.
Command sequence at a glance
The following sequence is a compact Debian or Ubuntu starting point; substitute the paths shown by your installed configuration and use the RHEL installation command where applicable.
Quick Recap
sudo apt update && sudo apt install aide- Read
/etc/aide/aide.confand any included fragments; confirmdatabase_in,database_out, monitored paths, and exclusions. sudo aide --config-checkwhen supported.sudo aide --init- Move the generated database, commonly
/var/lib/aide/aide.db.new, to the exactdatabase_inpath. sudo aide --check- Verify the supplied cron job or systemd timer and test report delivery.
- After approved changes, run
sudo aide --update, review the new file, and activate it as the next input database.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
