Detections
Analytics

AZLX-23-001065 - Amazon Linux 2023 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.

Information

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to Amazon Linux 2023. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.

Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of Amazon Linux 2023. Amazon Linux 2023's information management officer (IMO)/information system security officer (ISSO), and SAs must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

Notifications provided by information systems include messages to local computer consoles and/or hardware indications, such as lights.

This must account for operational requirements for availability for selecting an appropriate response. The organization may choose to shut down or restart the information system upon detecting a security function anomaly.

In Amazon Linux 2023, cronie is not included by default. Therefore, support for crontab is no longer provided by default. AWS recommends migrating to systemd timers for this functionality.

Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201

Solution

Configure Amazon Linux 2023 so the file integrity tool runs automatically on the system at least weekly and notifies designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel using either the crond service or systemd timers.

If using cron, ensure the cronie package is installed and enabled:

$ sudo dnf install cronie
$ sudo systemctl enable crond
$ sudo systemctl start crond

The following example output is generic. It will set cron to run AIDE daily and to send an email upon completion of the analysis:

$ sudo more /etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" [email protected]

If using systemd timers, create the file "/etc/systemd/system/aid.service" to run the "aide --check" command:

[Unit]
Description=Aide Check
[Service]
Type=simple
ExecStart=/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run"
[Install]
WantedBy=multi-user.target

Create the file "/etc/systemd/system/aide.timer" to run the AIDE check service at a specified time. The example below runs "aide --check" at 1:00 a.m. every day:

[Unit]
Description=Aide check every day at 1AM
[Timer]
OnCalendar=*-*-* 01:00:00
Unit=aide.service
[Install]
WantedBy=timers.target

Reload systemd:

$ sudo systemctl daemon-reload

Enabling the service will ensure the "aide --check" service will also start at boot time:

$ sudo systemctl enable aide.service

Start the timer:

$ sudo systemctl --now enable aide.timer

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Amazon_Linux_2023_V1R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-3(5), 800-53|SI-6b., 800-53|SI-6d., CAT|II, CCI|CCI-001744, CCI|CCI-002699, CCI|CCI-002702, Rule-ID|SV-274025r1192649_rule, STIG-ID|AZLX-23-001065, Vuln-ID|V-274025

Plugin: Unix

Control ID: 70f6825139fb2c198f028b1fba2ef76d3f2869f9dcd1532d39ffa2dfd82699fd