c40f54
1) Customize /etc/aide.conf to your liking. In particular, add
c40f54
   important directories and files which you would like to be
c40f54
   covered by integrity checks. Avoid files which are expected
c40f54
   to change frequently or which don't affect the safety of your
c40f54
   system.
c40f54
c40f54
2) Run "/usr/sbin/aide --init" to build the initial database.
c40f54
   With the default setup, that creates /var/lib/aide/aide.db.new.gz
c40f54
c40f54
3) Store /etc/aide.conf, /usr/sbin/aide and /var/lib/aide/aide.db.new.gz
c40f54
   in a secure location, e.g. on separate read-only media (such as
c40f54
   CD-ROM). Alternatively, keep MD5 fingerprints or GPG signatures
c40f54
   of those files in a secure location, so you have means to verify
c40f54
   that nobody modified those files.
c40f54
c40f54
4) Copy /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz
c40f54
   which is the location of the input database.
c40f54
c40f54
5) Run "/usr/sbin/aide --check" to check your system for inconsistencies
c40f54
   compared with the AIDE database. Prior to running a check manually,
c40f54
   ensure that the AIDE binary and database have not been modified
c40f54
   without your knowledge.
c40f54
   
c40f54
   Caution! 
c40f54
   
c40f54
   With the default setup, an AIDE check is not run periodically as a
c40f54
   cron job. It cannot be guaranteed that the AIDE binaries, config
c40f54
   file and database are intact. It is not recommended that you run
c40f54
   automated AIDE checks without verifying AIDE yourself frequently.
c40f54
   In addition to that, AIDE does not implement any password or
c40f54
   encryption protection for its own files.
c40f54
   
c40f54
   It is up to you how to put a file integrity checker to good effect
c40f54
   and how to set up automated checks if you think it adds a level of
c40f54
   safety (e.g. detecting failed/incomplete compromises or unauthorized
c40f54
   modification of special files). On a compromised system, the
c40f54
   intruder could disable the automated check. Or he could replace the
c40f54
   AIDE binary, config file and database easily when they are not
c40f54
   located on read-only media. 
c40f54