AIDE (Advanced Intrusion Detection Environment, pronounced “eyd”) is a file and directory integrity checker for Unix-like systems. It answers a narrow but vital security question: has anything on this machine changed since I last trusted it? AIDE builds a baseline database of the files you tell it to watch, recording cryptographic message digests alongside the usual file attributes, and later compares the live filesystem against that snapshot, reporting every addition, removal and modification. It began as a free replacement for the commercial Tripwire and has been a staple of Linux baseline control and rootkit detection for over two decades. The original authors were Rami Lehti and Pablo Virolainen (Tampere University of Technology) together with Richard van den Berg; the current maintainer is Hannes von Haugwitz. Written in C, the current release is 0.19.4 (30 August 2026), and it is packaged by essentially every major distribution.

Key Features

• Multiple message-digest algorithms — md5, sha1, rmd160, tiger, crc32, sha256, sha512 and whirlpool out of the box, plus gost, haval and crc32b when built with libmhash. Algorithms can be mixed per rule, so a fast digest can cover bulk paths while a strong one protects sensitive files.
• Rich attribute checking — file type, permissions, inode, uid, gid, link name, size, block count, number of links, mtime, ctime and atime, so changes that leave contents untouched (a chmod, a new hard link, a touched timestamp) are still surfaced.
• POSIX ACL, SELinux, xattr and e2fsattrs support — when compiled in, AIDE also watches access-control lists, SELinux contexts, extended attributes and extended filesystem attributes, capturing the metadata modern hardening depends on.
• Powerful regular-expression rules — include or exclude files and directories selectively from a plain-text config, with per-path attribute sets and predefined groups (for example the common R group for read-only data and L for log files), so /usr and /etc can be monitored at different depths.
• Compressed, version-tolerant database — the baseline is a plain-text (optionally gzip-compressed) database with a documented format, and AIDE can read databases written by older or newer versions, which simplifies upgrades.
• Standalone static binary — a self-contained binary makes client/server monitoring simple: build the baseline on one host, copy the tool and database to read-only media or another system, and run checks without installing anything.
• Built for scheduled runs — the Debian and Ubuntu packages ship a daily cron/systemd run that emails the report, so drift is reported automatically without a dedicated daemon.
• GnuPG-signed releases — source tarballs and git tags are signed by the maintainer, so a release can be verified before it is trusted.

Why Use AIDE?

Intrusion detection has two halves: catching an attacker in the act, and noticing that one already got in. AIDE covers the second. Because it compares against a baseline captured while the system was known good, it detects the quiet tampering a compromised host leaves behind — a replaced system binary, a newly setuid file, a modified /etc/passwd, a planted cron job. Unlike a signature-based rootkit scanner it needs no catalogue of known threats: anything that deviates from the baseline is a finding, including attacks nobody has seen before. It is small, dependency-light and runs happily on servers, routers and appliances where heavier tooling will not fit, which is why distributions ship it by default and why hardening benchmarks call for a file-integrity tool alongside other controls.

Use Cases

• Baseline an existing server — after a clean install and configuration, run aide --init to record the trusted state, then aide --check thereafter to catch drift.
• Detect rootkits and backdoors — replaced binaries, hidden files and modified configuration are all reported as differences from the baseline.
• Compliance and auditing — file-integrity monitoring is a standard requirement in hardening guides and audit frameworks; AIDE reports supply the evidence trail.
• Watch critical paths selectively — monitor /etc, /bin, /sbin and /usr, while excluding log and data directories that change constantly, to keep reports meaningful.
• Fleet checks with a static binary — take a database from a golden image and verify hosts that have no package manager or restricted access.

Platform

Linux (Debian, Ubuntu, openSUSE, SUSE, Red Hat, CentOS, Fedora, Gentoo, NixOS) · FreeBSD · OpenBSD · macOS (Homebrew, MacPorts) · and basically any modern Unix. Written in C and shipped by most distributions.

Licence

GNU General Public License v2 (GPL-2.0) — free and open source.

Website

aide.github.io