STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 must use cryptographic mechanisms to protect the integrity of audit tools.

DISA Rule

SV-248810r991567_rule

Vulnerability Number

V-248810

Group Title

SRG-OS-000278-GPOS-00108

Rule Version

OL08-00-030650

Severity

CAT II

CCI(s)

CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.

Weight

Fix Recommendation

Add or update the following lines to "/etc/aide.conf" to protect the integrity of the audit tools.

# Audit Tools
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Check Contents

Verify that Advanced Intrusion Detection Environment (AIDE) is properly configured to use cryptographic mechanisms to protect the integrity of audit tools.

Check the selection lines to ensure AIDE is configured to add/check with the following command:

$ sudo grep -E '(\/usr\/sbin\/(audit|au|rsys))' /etc/aide.conf

/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/rsyslogd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

If any of the audit tools listed above do not have an appropriate selection line, this is a finding.

Vulnerability Number

V-248810

Documentable

False

Rule Version

OL08-00-030650

Severity Override Guidance

Check Content Reference

Target Key

5416