STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

The OL 8 file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency.

DISA Rule

SV-248573r1134847_rule

Vulnerability Number

V-248573

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

OL08-00-010360

Severity

CAT II

CCI(s)

• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Configure the file integrity tool to run automatically on the system at least weekly and to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system.

The following example output is generic. It will set cron to run AIDE daily and to send an email at the completion of the analysis. The file path in the more command is exemplary. Common paths include /etc/cron.d/<filename>, /etc/cron.daily/<filename>, /etc/cron.hourly/<filename>, /etc/cron.weekly/<filename>, or /etc/cron.monthly/<filename>.

$ sudo more /etc/cron.daily/aide

#!/bin/bash
/usr/sbin/aide --check |/bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

Note: Per requirement OL08-00-010358, the "mailx" package must be installed on the system to enable email functionality.

Check Contents

Verify the operating system routinely checks the baseline configuration for unauthorized changes and notifies the SA when anomalies in the operation of any security functions are discovered.

Check that OL 8 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence.

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands:

To search for an aide script:

$ sudo find /usr/local/bin /root /usr/sbin /usr/bin -type f -name aide

To search for scheduled cron jobs:

$ sudo grep -r aide /etc/cron* /var/spool/cron /etc/anacrontab 2>/dev/null
/etc/cron.daily/aide: /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

Verify the contents of the scripts listed in the output and confirm that AIDE is configured to run automatically on at least a weekly basis.

If the file integrity application does not exist, a script file controlling the execution of the integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Vulnerability Number

V-248573

Documentable

False

Rule Version

OL08-00-010360

Severity Override Guidance

Verify the operating system routinely checks the baseline configuration for unauthorized changes and notifies the SA when anomalies in the operation of any security functions are discovered.

Check that OL 8 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence.

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if AIDE is installed on the system, use the following commands:

To search for an aide script:

$ sudo find /usr/local/bin /root /usr/sbin /usr/bin -type f -name aide

To search for scheduled cron jobs:

$ sudo grep -r aide /etc/cron* /var/spool/cron /etc/anacrontab 2>/dev/null
/etc/cron.daily/aide: /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily AIDE integrity check run" root@example_server_name.mil

Verify the contents of the scripts listed in the output and confirm that AIDE is configured to run automatically on at least a weekly basis.

If the file integrity application does not exist, a script file controlling the execution of the integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Check Content Reference

M

Target Key

5416