Detections
Analytics

1.4.1 Ensure AIDE is installed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system.

Note: The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Run prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.

Rationale:

By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.

Solution

Configure AIDE as appropriate for your environment. Consult the AIDE documentation for options.
Run the following command to install AIDE:

# zypper install aide

Run the following commands to initialize AIDE:

# aide --init

# mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

See Also

https://workbench.cisecurity.org/files/2854

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(5), CSCv6|2.2, CSCv7|14.9

Plugin: Unix

Control ID: 892a61db4d0fb742a8261f6dfed4a03401f7b3fba19db4277efa4fa25f18a497