The file integrity tool must use FIPS 140-2 approved cryptographic hashes for validating file contents.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22509	GEN006575	SV-45928r1_rule	ECSC-1	Low

Description
File integrity tools often use cryptographic hashes for verifying that file contents have not been altered. These hashes must be FIPS 140-2 approved.

STIG	Date
SUSE Linux Enterprise Server v11 for System z	2012-12-13

Details

Check Text ( C-43232r1_chk )
If using an Advanced Intrusion Detection Environment (AIDE), verify the configuration contains the "sha256" or "sha512" options for all monitored files and directories. Procedure: Check for the default location /etc/aide/aide.conf or: # find / -name aide.conf # egrep "[+]?(sha256\|sha512)" If the option is not present. This is a finding. If one of these options is not present. This is a finding. If using a different file integrity tool, check the configuration per tool documentation.

Check Text ( C-43232r1_chk )

If using an Advanced Intrusion Detection Environment (AIDE), verify the configuration contains the "sha256" or "sha512" options for all monitored files and directories.

Procedure:
Check for the default location /etc/aide/aide.conf
or:
# find / -name aide.conf

# egrep "[+]?(sha256|sha512)"
If the option is not present. This is a finding.
If one of these options is not present. This is a finding.

If using a different file integrity tool, check the configuration per tool documentation.

Fix Text (F-39304r1_fix)
If using AIDE, edit the configuration and add the "sha512" option for all monitored files and directories. If using a different file integrity tool, configure FIPS 140-2 approved cryptographic hashes per the tool's documentation.