documentation_complete: true

prodtype: rhel7,fedora

title: 'Configure Periodic Execution of AIDE'

description: |-
    At a minimum, AIDE should be configured to run a weekly scan. At most, AIDE should be run daily.
    To implement a daily execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
    <pre>05 4 * * * root /usr/sbin/aide --check</pre>
    To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <tt>/etc/crontab</tt>:
    <pre>05 4 * * 0 root /usr/sbin/aide --check</pre>
    AIDE can be executed periodically through other means; this is merely one example.
    The usage of cron's special time codes, such as  <tt>@daily</tt> and
    <tt>@weekly</tt> is acceptable.

rationale: |-
    By default, AIDE does not install itself for periodic execution. Periodically
    running AIDE is necessary to reveal unexpected changes in installed files.
    <br /><br />
    Unauthorized changes to the baseline configuration could make the system vulnerable
    to various attacks or allow unauthorized access to the operating system. Changes to
    operating system configurations can have unintended side effects, some of which may
    be relevant to security.
    <br /><br />
    Detecting such changes and providing an automated response can help avoid unintended,
    negative consequences that could ultimately affect the security state of the operating
    system. The operating system's Information Management Officer (IMO)/Information System
    Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
    monitoring system trap when there is an unauthorized modification of a configuration item.

severity: medium

identifiers:
    cce@rhel7: 26952-2

references:
    cis: 1.3.2
    cjis: 5.10.1.3
    disa: 1744
    nist: CM-3(d),CM-3(e),CM-3(5),CM-6(d),CM-6(3),SC-28,SI-7
    pcidss: Req-11.5
    srg: SRG-OS-000363-GPOS-00150
    stigid@rhel7: "020030"

ocil_clause: 'there is no output'

ocil: |-
    To determine that periodic AIDE execution has been scheduled, run the following command:
    <pre>$ grep aide /etc/crontab</pre>
    The output should return some similiar to the following:
    <pre>05 4 * * * root /usr/sbin/aide --check</pre>

    NOTE: The usage of special cron times, such as @daily or @weekly, is acceptable.
