[gentoo-server] Intrusion Detection

[Karl Zander]

The Gentoo Security Guide seems to recommend AIDE (Advanced Intrusion 
Detection Environment) .   And I would like to run that.   But given that 
files in /bin,  /sbin or /etc or other important places that AIDE may be 
monitoring can change when running emerge,  how management intensive is it 
to run AIDE or any other intrusion detection?

I think I read that AIDE was running on the Gentoo rsync server that was 
comprised so running it does seem like good practice.    Just trying to get 
a handle on what management tasks I will need to think about to make AIDE 
most useful.

-Karl