STIGQter: STIG Summary: SUSE Linux Enterprise Server 15 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The SUSE operating system must notify the System Administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions.

DISA Rule

SV-234864r622137_rule

Vulnerability Number

V-234864

Group Title

SRG-OS-000447-GPOS-00201

Rule Version

SLES-15-010570

Severity

CAT II

CCI(s)

• CCI-002702 - The information system shuts the information system down, restarts the information system, and/or initiates organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Configure the SUSE operating system to notify the SA when AIDE discovers anomalies in the operation of any security functions.

Create the aide crontab file in "/etc/cron.daily" and add following command replacing the "[E-MAIL]" parameter with a proper email address for the SA:

0 0 * * * /usr/sbin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

Check Contents

Verify the SUSE operating system notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Check to see if the aide cron job sends an email when executed with the following command:

> grep -i "aide" /etc/cron.*/aide
0 0 * * * /usr/sbin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/usr/bin/mail"), this is a finding.

Vulnerability Number

V-234864

Documentable

False

Rule Version

SLES-15-010570

Severity Override Guidance

Verify the SUSE operating system notifies the SA when AIDE discovers anomalies in the operation of any security functions.

Check to see if the aide cron job sends an email when executed with the following command:

> grep -i "aide" /etc/cron.*/aide
0 0 * * * /usr/sbin/aide --check | /bin/mail -s "aide integrity check run for <system name>" root@notareal.email

If the "aide" file does not exist under the "/etc/cron" directory structure or the cron job is not configured to execute a binary to send an email (such as "/usr/bin/mail"), this is a finding.

Check Content Reference

M

Target Key

5274

Comments