mediumauditverified ✓rollback-safe
Ensure AIDE runs periodically
aide-cron-check · RHEL ≥ 8 · 1 impl
Description
AIDE file integrity checks must be scheduled to run periodically via cron or systemd timer. Regular integrity checks are essential for detecting unauthorized file modifications.
Rationale
Installing AIDE is only useful if checks are run regularly. Without periodic scans, file modifications by attackers may go undetected for extended periods, allowing persistent access.
Check → Remediate
Checkcommand
systemctl is-enabled aidecheck.timer 2>/dev/null | grep -q enabled || grep -rE 'aide\s+(--check|--update|-C|-u)' /etc/crontab /etc/cron.d/ /etc/cron.daily/ /etc/cron.weekly/ /var/spool/cron/ 2>/dev/null
- expected_exit:
- 0
Remediatecron_job
- schedule:
- 0 5 * * *
- command:
- /usr/sbin/aide --check
- user:
- root
- file:
- /etc/cron.d/aide
Framework references
CIS
rhel9 6.1.2rhel10 6.1.2rhel8 6.1.2
STIG
V-280980 / RHEL-10-200633V-258135 / RHEL-09-651015
NIST 800-53
SI-7AU-2
Live verification
rhel10:checkrhel8:checkrhel9:check
#aide#file-integrity#cron#intrusion-detection