1.3.2 Ensure filesystem integrity is regularly checked

Information

Periodic checking of the filesystem integrity is needed to detect changes to the filesystem.

Rationale:

Periodic file checking allows the system administrator to determine on a regular basis if
critical files have been changed in an unauthorized fashion.

Solution

Run the following commands:

# cp ./config/aidecheck.service /etc/systemd/system/aidecheck.service
# cp ./config/aidecheck.timer /etc/systemd/system/aidecheck.timer
# chmod 0644 /etc/systemd/system/aidecheck.*
# systemctl reenable aidecheck.timer
# systemctl restart aidecheck.timer
# systemctl daemon-reload

or
Run the following command:

# crontab -u root -e

Add the following line to the crontab:

0 5 * * * /usr/sbin/aide --check

See Also

https://workbench.cisecurity.org/files/2420

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, CSCv6|3.5, CSCv7|14.9

Plugin: Unix

Control ID: 9c22a2fcbf63c1617787c4b081056c2e43114182b0539b9861d0558723856744