Cis Ubuntu1804 V220 1 2 1

1.2.1 Ensure AIDE is installed (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system.

Rationale

By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.

Audit Procedure

Command Line

Run the following command to verify aide is installed:

dpkg-query -s aide &>/dev/null && echo "aide is installed"

Run the following command to verify aide-common is installed:

dpkg-query -s aide-common &>/dev/null && echo "aide-common is installed"

Expected Result

aide is installed
aide-common is installed

Remediation

Command Line

Run the following command to install aide and aide-common:

apt install aide aide-common

Run the following commands to initialize AIDE:

aideinit
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

References

1. NIST SP 800-53 Rev. 5: AU-2

Additional Information

The prelinking feature can interfere with AIDE because it alters binaries to speed up their start up times. Run prelink -ua to restore the binaries to their prelinked state, thus avoiding false positives from AIDE.

CIS Controls

MITRE ATT&CK Mappings