STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must routinely check the baseline configuration for unauthorized changes and notify the system administrator (SA) when anomalies in the operation of any security functions are discovered.

DISA Rule

SV-274025r1192649_rule

Vulnerability Number

V-274025

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

AZLX-23-001065

Severity

CAT II

CCI(s)

CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

Fix Recommendation

Configure Amazon Linux 2023 so the file integrity tool runs automatically on the system at least weekly and notifies designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel using either the crond service or systemd timers.

If using cron, ensure the cronie package is installed and enabled:

$ sudo dnf install cronie
$ sudo systemctl enable crond
$ sudo systemctl start crond

The following example output is generic. It will set cron to run AIDE daily and to send an email upon completion of the analysis:

$ sudo more /etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

If using systemd timers, create the file "/etc/systemd/system/aid.service" to run the "aide --check" command:

[Unit]
Description=Aide Check
[Service]
Type=simple
ExecStart=/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run"
[Install]
WantedBy=multi-user.target

Create the file "/etc/systemd/system/aide.timer" to run the AIDE check service at a specified time. The example below runs "aide --check" at 1:00 a.m. every day:

[Unit]
Description=Aide check every day at 1AM
[Timer]
OnCalendar=*-*-* 01:00:00
Unit=aide.service
[Install]
WantedBy=timers.target

Reload systemd:

$ sudo systemctl daemon-reload

Enabling the service will ensure the "aide --check" service will also start at boot time:

$ sudo systemctl enable aide.service

Start the timer:

$ sudo systemctl --now enable aide.timer

Check Contents

Verify Amazon Linux 2023 routinely executes a file integrity scan for changes to the system baseline. The commands used in the example will use a daily occurrence.

If using cron, check that the cronie service is running:

$ systemctl status crond
o crond.service - Command Scheduler
Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-11-12 20:37:42 UTC; 7s ago

Check the cron directories for scripts controlling the execution and notification of results of the file integrity application. For example, if Advanced Intrusion Detection Environment (AIDE) is installed on the system, use the following commands:

$ ls -al /etc/cron.daily | grep aide
-rwxr-xr-x 1 root root 29 Nov 22 2015 aide

$ sudo grep aide /etc/crontab /var/spool/cron/root
/etc/crontab: 30 04 * * * root usr/sbin/aide
/var/spool/cron/root: 30 04 * * * root usr/sbin/aide

$ sudo more /etc/cron.daily/aide
#!/bin/bash
/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil

If using systemd timers, ensure the aide timer is enabled:

$ systemctl status aide.timer
o aide.timer - Aide check every day at 1AM
Loaded: loaded (/etc/systemd/system/aide.timer; enabled; preset: disabled)
Active: active (waiting) since Thu 2025-11-20 15:23:24 UTC; 37s ago
Trigger: Fri 2025-11-21 01:00:00 UTC; 9h left
Triggers: o aide.service

If the timer unit file has a different name, list all available timers with the following command:

$ systemctl list-timers

If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, or the file integrity application does not notify designated personnel of changes, this is a finding.

Vulnerability Number

V-274025

Documentable

False

Rule Version

AZLX-23-001065

Severity Override Guidance

Check Content Reference

Target Key

5700