AIDE File Integrity Monitor

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

AIDE (Advanced Intrusion Detection Environment) is the open source, GPL-2.0 licensed host-based file and directory integrity checker. It builds a cryptographic baseline database of the attributes of the files it watches - permissions, ownership, inode, size, timestamps and content hashes - and on every subsequent run reports exactly what has been added, removed or changed against that baseline. It is a host intrusion detection staple and a direct answer to compliance controls that mandate file-integrity monitoring, such as PCI-DSS requirement 11.5 and the CIS Benchmarks. This AMI delivers AIDE fully configured as a ready-to-run integrity-monitoring appliance - SSH in and the baseline and scheduled check are already in place.

## Why Choose This AMI Over Self-Installation

Standing AIDE up correctly is more subtle than installing a package: the baseline must be built on the real machine, the monitored scope must be tuned so the daily check is meaningful without drowning in noise, and the schedule and reporting must be wired up. This AMI handles all of it:

• Per-instance baseline, built at first boot - The baseline database is never baked into the image. It is generated on your own instance at first boot so it fingerprints your real machine, not the build server.
• Focused, hardened monitored scope - Executables, libraries, boot, kernel modules and /etc are watched out of the box, with volatile paths excluded so the report stays signal, not noise.
• Scheduled and logged - A systemd timer runs a daily integrity check and writes the diff report to /var/log/aide, ready for your log pipeline.
• Fail-closed by design - The scheduled check refuses to run unless a valid per-instance baseline is present, so a silent no-baseline state can never masquerade as a clean result.

## How File-Integrity Monitoring Works Here

• On first boot, AIDE initializes a baseline database describing your instance's monitored files
• A daily systemd timer runs an integrity check against that baseline
• The check reports every added, removed or changed file to /var/log/aide
• After intentional, reviewed changes (a package update, a config edit) you update the baseline with aideinit or aide --update
• There is no daemon, no network port and no credential - AIDE is a purely local command-line tool

## Getting Started

1. Launch the AMI on your preferred EC2 instance type

2. Connect over SSH using your key pair

3. Confirm the per-instance baseline built at first boot with sudo aide --check --config=/etc/aide/aide.conf

4. Review the daily report at /var/log/aide/aide.log

5. After any intentional change, refresh the baseline with sudo aideinit

## Security Practices

AIDE is installed unmodified from the operating system's official package archive, so it is covered by standard unattended security updates. The baseline database is generated per instance and stored read-restricted; for real tamper assurance, move a copy of the baseline off the instance or to read-only media. SSH access uses key-based authentication. AIDE opens no network socket and runs no daemon.

## Use Cases

• Compliance file-integrity monitoring - Satisfy PCI-DSS 11.5, CIS and similar controls that mandate FIM
• Host intrusion detection - Detect tampering of system binaries, libraries and configuration
• Change auditing - Get a reviewable daily record of what changed on a server
• Golden-image drift detection - Confirm a fleet instance still matches its intended state

## cloudimg Support

24/7 technical support by email and live chat covers baseline initialization and updates, tuning the monitored scope, interpreting integrity reports, wiring the schedule and reports into a log pipeline, and moving the baseline off-box for stronger assurance. Critical issues receive a one-hour average response.

## Next Steps

Contact support@cloudimg.co.uk to request a sample integrity report, schedule a monitored-scope tuning walkthrough, or ask any pre-purchase questions about the product.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.