STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must use cryptographic mechanisms to protect the integrity of audit tools.

DISA Rule

SV-270831r1135002_rule

Vulnerability Number

V-270831

Group Title

SRG-OS-000278-GPOS-00108

Rule Version

UBTU-24-909890

Severity

CAT II

CCI(s)

CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.

Weight

Fix Recommendation

Add or update the following selection lines for "/etc/aide/aide.conf" to protect the integrity of the audit tools:

# Audit Tools
/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Check Contents

Verify that Advanced Intrusion Detection Environment (AIDE) is properly configured to use cryptographic mechanisms to protect the integrity of audit tools with the following command:

$ egrep '(\/sbin\/(audit|au))' /etc/aide/aide.conf
/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

If any of the seven audit tools do not have appropriate selection lines, this is a finding.

Vulnerability Number

V-270831

Documentable

False

Rule Version

UBTU-24-909890

Severity Override Guidance

Check Content Reference

Target Key

5673