SV-238236r653883_rule
V-238236
SRG-OS-000446-GPOS-00200
UBTU-20-010074
CAT II
10
The cron file for AIDE is fairly complex as it creates the report. This file is installed with the "aide-common" package, and the default can be restored by copying it from the package:
Download the original package to the /tmp dir:
$ cd /tmp; apt download aide-common
Extract the aide script to its original place:
$ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | sudo tar -x ./usr/share/aide/config/cron.daily/aide -C /
Copy it to the cron.daily directory:
$ sudo cp -f /usr/share/aide/config/cron.daily/aide /etc/cron.daily/aide
Verify that the Advanced Intrusion Detection Environment (AIDE) default script used to check file integrity each 30 days or less is unchanged.
Download the original aide-common package in the /tmp directory:
$ cd /tmp; apt download aide-common
Fetch the SHA1 of the original script file:
$ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | tar -xO ./usr/share/aide/config/cron.daily/aide | sha1sum
32958374f18871e3f7dda27a58d721f471843e26 -
Compare with the SHA1 of the file in the daily or monthly cron directory:
$ sha1sum /etc/cron.{daily,monthly}/aide 2>/dev/null
32958374f18871e3f7dda27a58d721f471843e26 /etc/cron.daily/aide
If there is no AIDE script file in the cron directories, or the SHA1 value of at least one file in the daily or monthly cron directory does not match the SHA1 of the original, this is a finding.
V-238236
False
UBTU-20-010074
Verify that the Advanced Intrusion Detection Environment (AIDE) default script used to check file integrity each 30 days or less is unchanged.
Download the original aide-common package in the /tmp directory:
$ cd /tmp; apt download aide-common
Fetch the SHA1 of the original script file:
$ dpkg-deb --fsys-tarfile /tmp/aide-common_*.deb | tar -xO ./usr/share/aide/config/cron.daily/aide | sha1sum
32958374f18871e3f7dda27a58d721f471843e26 -
Compare with the SHA1 of the file in the daily or monthly cron directory:
$ sha1sum /etc/cron.{daily,monthly}/aide 2>/dev/null
32958374f18871e3f7dda27a58d721f471843e26 /etc/cron.daily/aide
If there is no AIDE script file in the cron directories, or the SHA1 value of at least one file in the daily or monthly cron directory does not match the SHA1 of the original, this is a finding.
M
5318