cis-ubuntu1804-v220-1-2-2

name	cis-ubuntu1804-v220-1-2-2
description	Ensure filesystem integrity is regularly checked
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","aide","file-integrity","cron","systemd"]
cis_id	1.2.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.2.2 Ensure filesystem integrity is regularly checked (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

Periodic checking of the filesystem integrity is needed to detect changes to the filesystem.

Rationale

Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion.

Audit Procedure

Command Line

Run the following commands to verify a cron job scheduled to run the aide check:

grep -Prs '^([^#\n\r]+\h+)?(\/usr\/s?bin\/|^\h*)aide(\.wrapper)?\h+(--check|([^#\n\r]+\h+)?\$AIDEARGS)\b' /etc/cron.* /etc/crontab /var/spool/cron/

Ensure a cron job in compliance with site policy is returned.

OR

Run the following commands to verify that aidecheck.service and aidecheck.timer are enabled and aidecheck.timer is running:

systemctl is-enabled aidecheck.service
systemctl is-enabled aidecheck.timer
systemctl status aidecheck.timer

Expected Result

A cron job or systemd timer configured to run AIDE checks regularly.

Remediation

Command Line

If cron will be used to schedule and run aide check:

crontab -u root -e

Add the following line to the crontab:

0 5 * * * /usr/bin/aide.wrapper --config /etc/aide/aide.conf --check

OR If aidecheck.service and aidecheck.timer will be used to schedule and run aide check:

Create or edit the file /etc/systemd/system/aidecheck.service and add the following lines:

[Unit]
Description=Aide Check

[Service]
Type=simple
ExecStart=/usr/bin/aide.wrapper --config /etc/aide/aide.conf --check

[Install]
WantedBy=multi-user.target

Create or edit the file /etc/systemd/system/aidecheck.timer and add the following lines:

[Unit]
Description=Aide check every day at 5AM

[Timer]
OnCalendar=*-*-* 05:00:00
Unit=aidecheck.service

[Install]
WantedBy=multi-user.target

Run the following commands:

chown root:root /etc/systemd/system/aidecheck.*
chmod 0644 /etc/systemd/system/aidecheck.*
systemctl daemon-reload
systemctl  aidecheck.service
systemctl --now  aidecheck.timer