STIGQter STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must have the Advanced Intrusion Detection Environment (AIDE) package installed.

DISA Rule

SV-280977r1195366_rule

Vulnerability Number

V-280977

Group Title

SRG-OS-000445-GPOS-00199

Rule Version

RHEL-10-200630

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure RHEL 10 so that "AIDE" is installed and initialized, and then perform a manual check.

Install AIDE:

$ sudo dnf -y install aide

Initialize AIDE:

$ sudo /usr/sbin/aide --init

Example output:

Start timestamp: 2025-04-03 10:09:04 -0600 (AIDE 0.16)
AIDE initialized database at /var/lib/aide/aide.db.new.gz

Number of entries: 86833

---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------

/var/lib/aide/aide.db.new.gz
MD5 : coZUtPHhoFoeD7+k54fUvQ==
SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM=
SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE
TGdBJ/uvZKc=
SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP
toei0nENVELJ1LPurjoMlRig6q69VR8l
+44EwO9eYyy9nnbzQsfG1g==

End timestamp: 2025-04-03 10:09:57 -0600 (run time: 0m 53s)

The new database must be renamed to be read by AIDE:

$ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Perform a manual check:

$ sudo /usr/sbin/aide --check

Example output:

2025-04-03 10:16:08 -0600 (AIDE 0.16)
AIDE found NO differences between database and filesystem. Looks okay!!

...

Check Contents

Verify RHEL 10 has the AIDE package installed with the following command:

$ sudo dnf list --installed aide
Installed Packages
aide.x86_64 0.18.6-8.el10_0.2 @rhel-10-for-x86_64-appstream-rpms

If AIDE is not installed, ask the system administrator how file integrity checks are performed on the system.

If no application is installed to perform integrity checks, this is a finding.

If AIDE is installed, determine if it has been initialized with the following command:

$ sudo /usr/sbin/aide --check

If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.

Vulnerability Number

V-280977

Documentable

False

Rule Version

RHEL-10-200630

Severity Override Guidance

Verify RHEL 10 has the AIDE package installed with the following command:

$ sudo dnf list --installed aide
Installed Packages
aide.x86_64 0.18.6-8.el10_0.2 @rhel-10-for-x86_64-appstream-rpms

If AIDE is not installed, ask the system administrator how file integrity checks are performed on the system.

If no application is installed to perform integrity checks, this is a finding.

If AIDE is installed, determine if it has been initialized with the following command:

$ sudo /usr/sbin/aide --check

If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.

Check Content Reference

M

Target Key

5733