Detections
Analytics

6.3.2 Ensure filesystem integrity is regularly checked

Information

Periodic checking of filesystem integrity detects unauthorized changes to files. AIDE (Advanced Intrusion Detection Environment) compares the current state of the filesystem against a previously initialized baseline database; this recommendation ensures that comparison runs automatically on a regular schedule rather than only on demand.

Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion. Running the integrity check on a defined schedule -- rather than manually or ad hoc -- ensures changes are detected consistently and reduces the window in which unauthorized modifications can go unnoticed.

Solution

Configure a systemd timer to run a periodic AIDE integrity check.

 - Create the file /etc/systemd/system/aidecheck.service with the following content:

[Unit]
Description=Aide Check

[Service]
Type=oneshot
ExecStart=/usr/sbin/aide --check

 - Create the file /etc/systemd/system/aidecheck.timer with the following content:

[Unit]
Description=Aide check every day at 5AM

[Timer]
OnCalendar=*-*-* 05:00:00
Persistent=true
Unit=aidecheck.service

[Install]
WantedBy=timers.target

 - Run the following commands to set access on the unit files, reload systemd, and enable the timer:

# chown root:root /etc/systemd/system/aidecheck.service /etc/systemd/system/aidecheck.timer
# chmod 0644 /etc/systemd/system/aidecheck.service /etc/systemd/system/aidecheck.timer
# systemctl daemon-reload
# systemctl enable --now aidecheck.timer

Impact:

Scheduled integrity checks consume CPU and I/O when they run; choose a schedule and time that balance timely detection against system load.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, 800-53|SI-7, CSCv7|14.9

Plugin: Unix

Control ID: 9c77c1196e5f3878b1d51ffc7e55117c0f3c016b8509e4bcd73ba59b104d2d77