STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.

DISA Rule

SV-269457r1050340_rule

Vulnerability Number

V-269457

Group Title

SRG-OS-000447-GPOS-00201

Rule Version

ALMA-09-045450

Severity

CAT II

CCI(s)

• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.

Weight

10

Fix Recommendation

Configure the file integrity tool to run automatically on the system at least weekly and to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system.

The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis:

$ more /etc/cron.d/0aide

/usr/sbin/aide --check | echo "Subject: $HOSTNAME - Daily aide integrity check run" | /bin/mail -t root

Check Contents

Verify that AlmaLinux OS 9 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence.

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if Advanced Intrusion Detection Environment (AIDE) is installed on the system, use the following commands:

$ find /etc/cron* -name '*aide*'

/etc/cron.d/0aide

$ grep aide /etc/crontab /var/spool/cron/root

/var/spool/cron/root:30 04 * * * root /usr/sbin/aide --check

$ more /etc/cron.d/aide

@daily root /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root

If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Vulnerability Number

V-269457

Documentable

False

Rule Version

ALMA-09-045450

Severity Override Guidance

Verify that AlmaLinux OS 9 routinely executes a file integrity scan for changes to the system baseline. The command used in the example will use a daily occurrence.

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if Advanced Intrusion Detection Environment (AIDE) is installed on the system, use the following commands:

$ find /etc/cron* -name '*aide*'

/etc/cron.d/0aide

$ grep aide /etc/crontab /var/spool/cron/root

/var/spool/cron/root:30 04 * * * root /usr/sbin/aide --check

$ more /etc/cron.d/aide

@daily root /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root

If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Check Content Reference

M

Target Key

5664