File Integrity with AIDE¶

Auditing records who changed a file. AIDE answers a different question: has any system file changed since the last time you looked? It hashes every file it's told to watch and reports differences. The benchmark makes it Level 2 (CIS 6.3.1 to 6.3.3), and on a competition image it's most useful right at the start: initialize it after the first snapshot and you can see everything the round changed.

Install and initialize¶

sudo apt install -y aide aide-common
sudo aideinit
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

aideinit walks the filesystem according to /etc/aide/aide.conf and the rules in /etc/aide/aide.conf.d/, which takes a few minutes. The result is the baseline database.

Check¶

sudo aide --check --config /etc/aide/aide.conf

The report lists added, removed, and changed files with which attributes changed (size, hash, permissions, owner). After you finish hardening and want a new baseline: sudo aide --update and move aide.db.new over aide.db again.

Schedule it¶

sudo systemctl unmask dailyaidecheck.timer dailyaidecheck.service
sudo systemctl enable --now dailyaidecheck.timer
systemctl list-timers | grep aide

(CIS 6.3.2.) The Debian package also ships a daily cron job in /etc/cron.daily/aide that mails the report to root; the STIG wants that default script in place (UBTU-22-651025) and the report not silenced: SILENTREPORTS=no in /etc/default/aide (UBTU-22-651020).

Watch the audit tools¶

CIS 6.3.3 wants AIDE to specifically track the auditd binaries so that a tampered auditctl is noticed. Add to /etc/aide/aide.conf.d/99-audit-tools:

/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Then re-initialize so the baseline includes them.

Verify¶

dpkg -l aide | grep ^ii
ls -l /var/lib/aide/aide.db
systemctl is-enabled dailyaidecheck.timer

Example¶

AIDE isn't installed. Install it, initialize, and finish the rest of the site. An aide --check at the end lists /usr/bin/ls as changed (hash and size), which the updates explain, and /usr/local/bin/backup.sh as changed, which they don't: someone edited the script root's cron runs. Read it.

Try it¶

Initialize AIDE, change one file in /etc, run aide --check, read the report.
Update the baseline and check again.

Build it¶

Add aide --check to the end of your round: it lists everything you changed, which is your log's cross-check.

Next¶

Back to the Linux overview