Detections
Analytics

5.3.1 Ensure AIDE is installed

Information

Advanced Intrusion Detection Environment (AIDE) is an intrusion detection tool that uses predefined rules to check the integrity of files and directories in the FreeBSD operating system. AIDE has its own database for this purpose.

aide takes a snapshot of files and directories, including modification times, permissions, and file hashes. This snapshot can then be used to compare against the current state of the filesystem to detect system modifications.

By monitoring the filesystem state, compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.

Solution

Run the following command to install aide :

# pkg install aide

Configure aide as appropriate for your environment. Consult the aide documentation for options.

Initialize aide :

Run the following commands:

# aide --init # mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, CSCv7|14.9

Plugin: Unix

Control ID: a0a82864bf4bf2994ecd79dc6de99791b640f1efbcff939cbaa6330937e4e3e7