Configure AIDE to Verify the Audit Tools

Classification:

compliance

Framework:

Control:

Description

The operating system file integrity tool must be configured to protect the integrity of the audit tools.

Rationale

Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

Audit tools include but are not limited to vendor-provided and open-source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

It is not uncommon for attackers to replace the audit tools or inject code into the existing tools to provide the capability to hide or erase system activity from the audit logs.

To address this risk, audit tools must be cryptographically signed to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

DEBIAN\_FRONTEND=noninteractive apt-get install -y "aide"










if grep -i '^.\*/usr/sbin/auditctl.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/auditctl.\*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/auditd.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/auditd.\*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/ausearch.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/ausearch.\*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/aureport.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/aureport.\*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/autrace.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/autrace.\*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/augenrules.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/augenrules.\*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

if grep -i '^.\*/usr/sbin/audispd.\*$' /etc/aide/aide.conf; then
sed -i "s#.\*/usr/sbin/audispd.\*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512#" /etc/aide/aide.conf
else
echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512" >> /etc/aide/aide.conf
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi