AIDE (Advanced Intrusion Detection Environment is a file and directory integrity checker. It can be used to detect unauthorized monitored files and directories. AIDE was written to be a simple and free alternative to Tripwire
It creates a database from the regular expression rules that it finds from the config file(s). Once this database is initialized it can be used to verify the integrity of the files. It has several message digest algorithms (see below) that are used to check the integrity of the file. All of the usual file attributes can also be checked for inconsistencies. It can read databases from older or newer versions. See the manual pages within the distribution for further info.
AIDE is free and open source software.
Key Features
- Supported message digest algorithms: md5, sha1, rmd160, tiger, crc32, sha256, sha512, whirlpool (additionally with libmhash: gost, haval, crc32b).
- Supported file attributes: File type, Permissions, Inode, Uid, Gid, Link name, Size, Block count, Number of links, Mtime, Ctime and Atime.
- Support for Posix ACL, SELinux, XAttrs and Extended file system attributes if support is compiled in.
- Plain text configuration files and database for simplicity.
- Powerful regular expression support to selectively include or exclude files and directories to be monitored.
- gzip database compression if zlib support is compiled in.
- Stand alone static binary for easy client/server monitoring configurations.
Website: aide.github.io
Support: GitHub Code Repository
Developer: Rami Lehti, Pablo Virolainen and contributors. Maintainers: Richard van den Berg, Hannes von Haugwitz
License: GNU General Public License v2.0
AIDE is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.