The operating system must employ automated mechanisms, per organization defined frequency, to detect the addition of unauthorized components/devices into the operating system.

The operating system must employ automated mechanisms, per organization defined frequency, to detect the addition of unauthorized components/devices into the operating system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-219572	OL6-00-000303	SV-219572r793829_rule		Medium

Description
By default, AIDE does not install itself for periodic execution. Periodically running AIDE may reveal unexpected changes in installed files.

STIG	Date
Oracle Linux 6 Security Technical Implementation Guide	2021-12-03

Details

Check Text ( C-21297r358256_chk )
To determine that periodic AIDE execution has been scheduled, run the following command: # grep aide /etc/crontab /etc/cron./ If there is no output, this is a finding.

Fix Text (F-21296r358257_fix)
AIDE should be executed on a periodic basis to check for changes. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab: 05 4 * * * root /usr/sbin/aide --check AIDE can be executed periodically through other means; this is merely one example.