documentation_complete: true


title: 'Build and Test AIDE Database'

description: |-
    Run the following command to generate a new database:
    {{% if 'ubuntu' in product or 'debian' in product %}}
    <pre>$ sudo aideinit</pre>
    {{% else %}}
    <pre>$ sudo {{{ aide_bin_path }}} --init</pre>
    {{% endif %}}
    By default, the database will be written to the file
    {{% if 'ubuntu' in product or 'sle' in product or 'slmicro' in product or 'debian' in product %}}
    <tt>/var/lib/aide/aide.db.new</tt>.
    {{% else %}}
    <tt>/var/lib/aide/aide.db.new.gz</tt>.
    {{% endif %}}
    Storing the database, the configuration file <tt>/etc/aide.conf</tt>, and the binary
    <tt>{{{ aide_bin_path }}}</tt>
    (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
    The newly-generated database can be installed as follows:
    {{% if 'ubuntu' in product or 'sle' in product or 'slmicro' in product or 'debian' in product %}}
    <pre>$ sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db</pre>
    {{% else %}}
    <pre>$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</pre>
    {{% endif %}}
    To initiate a manual check, run the following command:
    <pre>$ sudo {{{ aide_bin_path }}} --check</pre>
    If this check produces any unexpected output, investigate.

rationale: |-
    For AIDE to be effective, an initial database of "known-good" information about files
    must be captured and it should be able to be verified against the installed files.

warnings:
    - general: |-
        In RHEL Image Mode (bootc) systems, the AIDE database must be regenerated after each system update.
        Image Mode systems receive updates through new container images that may include modified files.
        After applying system updates, run the following commands to regenerate the AIDE database:
        <pre>$ sudo {{{ aide_bin_path }}} --init</pre>
        Then replace the existing database:
        <pre>$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</pre>
        Failure to regenerate the AIDE database after updates will result in false positive alerts
        for legitimate system changes introduced by the update process.

severity: medium

identifiers:
    cce@rhel8: CCE-80675-2
    cce@rhel9: CCE-83438-2
    cce@rhel10: CCE-86942-0
    cce@sle12: CCE-91483-8
    cce@sle15: CCE-85787-0
    cce@sle16: CCE-95701-9
    cce@slmicro5: CCE-93710-2
    cce@slmicro6: CCE-94713-5

references:
    cis-csc: 1,11,12,13,14,15,16,2,3,5,7,8,9
    cis@sle12: 1.4.1
    cis@sle15: 1.4.1
    cjis: 5.10.1.3
    cobit5: APO01.06,BAI01.06,BAI02.01,BAI03.05,BAI06.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS03.05,DSS04.07,DSS05.02,DSS05.03,DSS05.05,DSS05.07,DSS06.02,DSS06.06
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3,4.3.4.4.4
    isa-62443-2013: 'SR 3.1,SR 3.3,SR 3.4,SR 3.8,SR 4.1,SR 6.2,SR 7.6'
    iso27001-2013: A.11.2.4,A.12.1.2,A.12.2.1,A.12.4.1,A.12.5.1,A.12.6.2,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.14.2.7,A.15.2.1,A.8.2.3
    nist: CM-6(a)
    nist-csf: DE.CM-1,DE.CM-7,PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1,PR.IP-3
    pcidss: Req-11.5
    srg: SRG-OS-000445-GPOS-00199
    stigid@ol7: OL07-00-020029
    stigid@ol8: OL08-00-010359
    stigid@sle12: SLES-12-010499
    stigid@sle15: SLES-15-010419

ocil_clause: 'there is no database file'

ocil: |-
    To find the location of the AIDE database file, run the following command:
    <pre>$ sudo ls -l <i>DBDIR</i>/<i>database_file_name</i></pre>
