CME-1004
AIDE / File Integrity Monitoring
Description
Detects unauthorized modifications to critical system files by comparing against a known-good baseline database. Scheduled or continuous monitoring of /etc, /bin, /sbin, /usr.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Integrity (I) | H → L | Compensating control: file modifications detected, alerting triggered |
CWE Relationships
Verification
Verify AIDE is installed and database is initialized
$ aide --check 2>/dev/null; echo $?
# Expected: 0
# Expected: 0
Platform: linux
Remediation
linux
AIDE file integrity monitoring with systemd timer
dnf install -y aide
aide --init && mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
printf '[Unit]\nDescription=AIDE integrity check\n\n[Service]\nType=oneshot\nExecStart=/usr/sbin/aide --check\n' > /etc/systemd/system/aide-check.service && printf '[Unit]\nDescription=Daily AIDE integrity check\n\n[Timer]\nOnCalendar=daily\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n' > /etc/systemd/system/aide-check.timer && systemctl daemon-reload && systemctl enable --now aide-check.timer