mediumauditverified ✓✓
Install and initialize AIDE
aide-installed · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls
Description
AIDE (Advanced Intrusion Detection Environment) must be installed and its database initialized to provide filesystem integrity monitoring. AIDE detects unauthorized modifications to system files.
Rationale
Without file integrity monitoring, unauthorized modifications to critical system files (binaries, libraries, configuration) may go undetected. AIDE provides a baseline against which changes are compared.
Check → Remediate
Checkcomposed · 2 sub-checks (all must pass)
- 1. package_state:
- name=aide state=present
- 2. file_exists:
- path=/var/lib/aide/aide.db.gz
Remediatepackage_present
- name:
- aide
Framework references
CIS
rhel8 6.1.1rhel9 6.1.1rhel10 6.1.1
STIG
V-230263 / RHEL-08-010360V-251710 / RHEL-08-010359V-258134 / RHEL-09-651010V-280977 / RHEL-10-200630V-270649 / UBTU-24-100100V-260582 / UBTU-22-651010
NIST 800-53
SC-28SI-7
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:fullubuntu24:full
#aide#file-integrity#intrusion-detection