A file integrity baseline including cryptographic hashes must be created.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-27250	GEN000140-2	SV-34549r3_rule		Medium

Description
A file integrity baseline is a collection of file metadata that is to evaluate the integrity of the system. A minimal baseline must contain metadata for all device files, setuid files, setgid files, system libraries, system binaries, and system configuration files. The minimal metadata must consist of the mode, owner, group owner, and modification times. For regular files, metadata must also include file size and a cryptographic hash of the file's contents.

Description

A file integrity baseline is a collection of file metadata that is to evaluate the integrity of the system. A minimal baseline must contain metadata for all device files, setuid files, setgid files, system libraries, system binaries, and system configuration files. The minimal metadata must consist of the mode, owner, group owner, and modification times. For regular files, metadata must also include file size and a cryptographic hash of the file's contents.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2017-03-01

Details

Check Text ( C-37553r4_chk )
Verify a system integrity baseline exists. The Advanced Intrusion Detection Environment (AIDE) is included in the distribution of RHEL. Other host intrusion detection system (HIDS) software is available but must be checked manually. Procedure: # grep DBDIR /etc/aide.conf If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding. Examine the response for "database" this indicates the location of the system integrity baseline database used as input to a comparison. # ls -la If no "database" file as defined in /etc/aide.conf exists a system integrity baseline has not been created, this is a finding. Examine /etc/aide.conf to ensure some form of cryptographic hash (i.e. md5,rmd160,sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash. If the site has defined rules to replace the functionality provided by the default "NORMAL" and "LSPP" rules but DOES NOT include cryptographic hashes, this is a finding. Otherwise, if any element used to define the "NORMAL" and "LSPP" rules has been modified resulting in cryptographic hashes not being used, this is a finding. If any other modification to the default /etc/aide.conf file have been made resulting in rules which do not include cryptographic hashes on appropriate files, this is a finding.

Check Text ( C-37553r4_chk )

Verify a system integrity baseline exists. The Advanced Intrusion Detection Environment (AIDE) is included in the distribution of RHEL. Other host intrusion detection system (HIDS) software is available but must be checked manually.

Procedure:
# grep DBDIR /etc/aide.conf

If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding.

Examine the response for "database" this indicates the location of the system integrity baseline database used as input to a comparison.
# ls -la

If no "database" file as defined in /etc/aide.conf exists a system integrity baseline has not been created, this is a finding.

Examine /etc/aide.conf to ensure some form of cryptographic hash (i.e. md5,rmd160,sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.

If the site has defined rules to replace the functionality provided by the default "NORMAL" and "LSPP" rules but DOES NOT include cryptographic hashes, this is a finding.

Otherwise, if any element used to define the "NORMAL" and "LSPP" rules has been modified resulting in cryptographic hashes not being used, this is a finding.

If any other modification to the default /etc/aide.conf file have been made resulting in rules which do not include cryptographic hashes on appropriate files, this is a finding.

Fix Text (F-32799r4_fix)
Use AIDE to create a file integrity baseline, including cryptographic hashes, for the system. Configure the /etc/aide.conf file to ensure some form of cryptographic hash (e.g., md5,rmd160,sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.