Detections
Analytics

6.3.1 Ensure AIDE is installed

Information

Advanced Intrusion Detection Environment (AIDE) is a intrusion detection tool that uses predefined rules to check the integrity of files and directories in the Linux operating system. AIDE has its own database to check the integrity of files and directories.

aide takes a snapshot of files and directories including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system.

By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.

Solution

- Run the following command to install aide :

# dnf install aide

 -

Configure aide as appropriate for your environment. Consult the aide documentation for options.

 -

Run the following command to Initialize aide :

# aide --init

 - Run the following command to create a baseline copy of the AIDE database:

# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Impact:

Installing AIDE and initializing its database consumes CPU, I/O, and disk space; the initial aide --init may take time on large filesystems.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, 800-53|SI-7, CSCv7|14.9

Plugin: Unix

Control ID: a7fa0df4ba9ae5028a9f93b782e8b442a2e0e561a4dac1aa0272d59f590cfc41