STIGQter: STIG Summary: SLES 12 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Advanced Intrusion Detection Environment (AIDE) must verify the baseline SUSE operating system configuration at least weekly.

DISA Rule

SV-217148r603262_rule

Vulnerability Number

V-217148

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

SLES-12-010500

Severity

CAT II

CCI(s)

• CCI-002696 - The information system verifies correct operation of organization-defined security functions.
• CCI-002699 - The information system performs verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
• CCI-001744 - The information system implements organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.

Weight

10

Fix Recommendation

Configure the SUSE operating system to check the baseline configuration for unauthorized changes at least once weekly.

If the "aide" package is not installed, install it with the following command:

# sudo zypper in aide

Configure the file integrity tool to automatically run on the system at least weekly.

The following example output is generic. It will set cron to run AIDE weekly, but other file integrity tools may be used:

# sudo crontab -l

0 0 * * 6 /usr/sbin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

Check Contents

Verify the SUSE operating system checks the baseline configuration for unauthorized changes at least once weekly.

Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.

Check to see if the "aide" package is installed on the system with the following command:

# sudo zypper if aide | grep "Installed"

Installed: Yes

If the "aide" package is not installed, ask the System Administrator (SA) how file integrity checks are performed on the system.

Check for a "crontab" that controls the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:

# sudo crontab -l

0 0 * * 6 /usr/bin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

If the file integrity application does not exist, or a "crontab" entry does not exist, check the cron directories for a script that runs the file integrity application:

# ls -al /etc/cron.daily /etc/cron.weekly

Inspect the file and ensure that the file integrity tool is being executed.

If a file integrity tool is not configured in the crontab or in a script that runs at least weekly, this is a finding.

Vulnerability Number

V-217148

Documentable

False

Rule Version

SLES-12-010500

Severity Override Guidance

Verify the SUSE operating system checks the baseline configuration for unauthorized changes at least once weekly.

Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.

Check to see if the "aide" package is installed on the system with the following command:

# sudo zypper if aide | grep "Installed"

Installed: Yes

If the "aide" package is not installed, ask the System Administrator (SA) how file integrity checks are performed on the system.

Check for a "crontab" that controls the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:

# sudo crontab -l

0 0 * * 6 /usr/bin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

If the file integrity application does not exist, or a "crontab" entry does not exist, check the cron directories for a script that runs the file integrity application:

# ls -al /etc/cron.daily /etc/cron.weekly

Inspect the file and ensure that the file integrity tool is being executed.

If a file integrity tool is not configured in the crontab or in a script that runs at least weekly, this is a finding.

Check Content Reference

M

Target Key

4033

Comments