cyberstrikeus 1.3.1 Ensure AIDE is installed (Scored)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system.
Rationale
By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.
Audit Procedure
Run the following command and verify AIDE is installed:
dpkg -s aide
Expected Result
The output should show that the aide package is installed with status install ok installed.
Remediation
Run the following command to install AIDE:
apt-get install aide aide-common
Configure AIDE as appropriate for your environment. Consult the AIDE documentation for options. Initialize AIDE:
aideinit
Default Value
AIDE is not installed by default.
Notes
The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Run prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.
References
- AIDE stable manual: http://aide.sourceforge.net/stable/manual.html
Profile
- Level 1 - Server
- Level 1 - Workstation