Detections
Analytics

6.3.4 Ensure report_url is configured

Information

The report_url directive in aide.conf names the destination(s) to which AIDE writes each integrity check's report. It accepts multiple destinations and supports a syslog:<facility> target - where <facility> is a syslog facility, such as one of LOG_LOCAL0 through LOG_LOCAL7 - that sends the report to the system log rather than, or in addition to, a local file. AIDE has no built-in mail transport; syslog is its native mechanism for directing the report to the system logging service.

A scheduled integrity check is only useful if its findings reach a monitored location. When the report is written only to a local file - or to standard output that the scheduling job discards - an unauthorized addition, modification, or deletion of a critical system file or audit tool can be recorded where no one is watching, and on the same host an attacker may be able to alter or delete it. Writing the report to the system log routes integrity findings into the centrally collected, retained, and access-controlled log stream, so discrepancies are preserved off the checked file's local context and are available for review and alerting.

Solution

Edit /etc/aide.conf and add a report_url directive that writes the check report to the system log, using a syslog facility that the system logging service is configured to collect (the local-use facilities LOG_LOCAL0 through LOG_LOCAL7 are commonly used for this):

report_url=syslog:<facility>

Example:

report_url=syslog:LOG_LOCAL0

AIDE supports multiple report_url destinations, so an existing destination (such as report_url=file:/var/log/aide.log ) may be kept alongside the syslog entry. Ensure the system logging service is configured to collect and retain the selected facility (see the logging recommendations) so the report is captured in the central log stream.

Impact:

Integrity-check reports written to the system log add to log volume, and a ruleset that has not been tuned to exclude files expected to change frequently can generate sizable or noisy log entries. The system logging service must be configured (see the logging recommendations) for the report to be collected and retained.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, 800-53|SI-7, 800-53|SI-7(2), CSCv7|14.9

Plugin: Unix

Control ID: 4411450ef2c274d2e903adf7068a5b5c6921292f31060f8cb03ac13529c9a8be