A file integrity baseline including cryptographic hashes must be maintained.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-27251	GEN000140-3	SV-34550r1_rule	DCSW-1	Medium

Description
A file integrity baseline is a collection of file metadata which is to evaluate the integrity of the system. A minimal baseline must contain metadata for all device files, setuid files, setgid files, system libraries, system binaries, and system configuration files. The minimal metadata must consist of the mode, owner, group owner, and modification times. For regular files, metadata must also include file size and a cryptographic hash of the file’s contents.

Description

A file integrity baseline is a collection of file metadata which is to evaluate the integrity of the system. A minimal baseline must contain metadata for all device files, setuid files, setgid files, system libraries, system binaries, and system configuration files. The minimal metadata must consist of the mode, owner, group owner, and modification times. For regular files, metadata must also include file size and a cryptographic hash of the file’s contents.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2013-01-17

Details

Check Text ( C-37565r1_chk )
Verify a system integrity baseline is maintained. The baseline has been updated to be consistent with the latest approved system configuration changes. The Advanced Intrusion Detection Environment (AIDE) is included in the distribution of RHEL-5. Other host intrusion detection system (HIDS) software is available but must be checked manually. Procedure: # grep DBDIR /etc/aide.conf If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding. Examine the response for "database" indicates the location of the system integrity baseline database used as input to a comparison. # ls -la If the no "database" file as defined in /etc/aide.conf a system integrity baseline has not been created, this is a finding. Ask the SA when the last approved system configuration changes occurred. If the modification date of the AIDE database is prior to the last approved configuration change, this is a finding.

Check Text ( C-37565r1_chk )

Verify a system integrity baseline is maintained. The baseline has been updated to be consistent with the latest approved system configuration changes. The Advanced Intrusion Detection Environment (AIDE) is included in the distribution of RHEL-5. Other host intrusion detection system (HIDS) software is available but must be checked manually.

Procedure:
# grep DBDIR /etc/aide.conf

If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding.

Examine the response for "database" indicates the location of the system integrity baseline database used as input to a comparison.
# ls -la

If the no "database" file as defined in /etc/aide.conf a system integrity baseline has not been created, this is a finding.

Ask the SA when the last approved system configuration changes occurred. If the modification date of the AIDE database is prior to the last approved configuration change, this is a finding.

Fix Text (F-32808r1_fix)
Regularly rebuild the integrity baseline, including cryptographic hashes, for the system to be consistent with the latest approved system configuration. Procedure: After an approved modification to the system configuration has been made perform: # aide -u This will update the database.