/etc md5+p+u+g #check for checksun, permission, user, and group under /etc

database=file:/var/lib/aide.db
database_out=file:/var/lib/aide.db.new
report_url=file:/var/log/aide.out

#AIDE conf

   # Here are all the things we can check - these are the default rules 
   #
   #p:      permissions
   #i:      inode
   #n:      number of links
   #l:      link name
   #u:      user
   #g:      group
   #s:      size
   #b:      block count
   #m:      mtime
   #a:      atime
   #c:      ctime
   #S:      check for growing size
   #I:      ignore changed filename
   #md5:    md5 checksum
   #sha1:   sha1 checksum
   #sha256: sha256 checksum
   #sha512: sha512 checksum
   #rmd160: rmd160 checksum
   #tiger:  tiger checksum
   #haval:  haval checksum
   #crc32:  crc32 checksum
   #R:      p+i+l+n+u+g+s+m+c+acl+selinux+xattrs+md5
   #L:      p+i+l+n+u+g+acl+selinux+xattrs
   #E:      Empty group
   #>:      Growing logfile p+l+u+g+i+n+S+acl+selinux+xattrs
   #The following are available if you have mhash support enabled:
   #gost:   gost checksum
   #whirlpool: whirlpool checksum
   #The following are available when explicitly enabled using configure:
   #acl:    access control list
   #selinux SELinux security context
   #xattr:  extended file attributes

   # You can alse create custom rules - my home made rule definition goes like this 
   #
   MyRule = p+i+n+u+g+s+b+m+c+md5+sha1 

   # Next decide what directories/files you want in the database

   /etc p+i+u+g     #check only permissions, inode, user and group for etc
   /bin MyRule      # apply the custom rule to the files in bin 
   /sbin MyRule     # apply the same custom rule to the files in sbin 
   /var MyRule		
   !/var/log/.*     # ignore the log dir it changes too often
   !/var/spool/.*   # ignore spool dirs as they change too often
   !/var/adm/utmp$  # ignore the file /var/adm/utmp

aide --init
cp /var/lib/aide.db.new /var/lib/aide.db

aide --check
less /var/log/aide.out

aide --update
cp /var/lib/aide.db.new /var/lib/aide.db

01 * * * * root aide --check || mutt -s AIDE_WARN_hostname  someone@somewhere.com < /var/log/aide.out