To start file-integrity checking with AIDE, you must install the corresponding package and initiate the AIDE database.
Before you begin
- The
AppStream repository is enabled.
Procedure
-
Install the
aide package:
-
Generate an initial database:
Start timestamp: 2024-07-08 10:39:23 -0400 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz
Number of entries: 55856
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
/var/lib/aide/aide.db.new.gz
…
SHA512 : mZaWoGzL2m6ZcyyZ/AXTIowliEXWSZqx
IFYImY4f7id4u+Bq8WeuSE2jasZur/A4
FPBFaBkoCFHdoE/FW/V94Q==
-
Optional: In the default configuration, the
aide --init command checks just a set of directories and files defined in the /etc/aide.conf file. To include additional directories or files in the AIDE database, and to change their watched parameters, edit /etc/aide.conf accordingly.
-
To start using the database, remove the
.new substring from the initial database file name:
# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
-
Optional: To change the location of the AIDE database, edit the
/etc/aide.conf file and modify the DBDIR value. For additional security, store the database, configuration, and the /usr/sbin/aide binary file in a secure location such as a read-only media.