STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must use cryptographic mechanisms to protect the integrity of audit tools.

DISA Rule

SV-280978r1165289_rule

Vulnerability Number

V-280978

Group Title

SRG-OS-000278-GPOS-00108

Rule Version

RHEL-10-200631

Severity

CAT I

CCI(s)

• CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.

Weight

10

Fix Recommendation

Configure RHEL 10 to use cryptographic mechanisms to protect the integrity of audit tools.

Add or update the following lines to "/etc/aide.conf" to protect the integrity of the audit tools.

/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

Check Contents

Verify RHEL 10 Advanced Intrusion Detection Environment (AIDE) is properly configured to protect the integrity of the audit tools.

Verify the explicit rules for the audit tools with the following command:

$ sudo grep /usr/sbin/au /etc/aide.conf
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system.

If any of the audit tools listed above do not have a corresponding line, ask the SA to indicate what cryptographic mechanisms are being used to protect the integrity of the audit tools.

If there is no evidence of integrity protection, this is a finding.

Vulnerability Number

V-280978

Documentable

False

Rule Version

RHEL-10-200631

Severity Override Guidance

Verify RHEL 10 Advanced Intrusion Detection Environment (AIDE) is properly configured to protect the integrity of the audit tools.

Verify the explicit rules for the audit tools with the following command:

$ sudo grep /usr/sbin/au /etc/aide.conf
/usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512

If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system.

If any of the audit tools listed above do not have a corresponding line, ask the SA to indicate what cryptographic mechanisms are being used to protect the integrity of the audit tools.

If there is no evidence of integrity protection, this is a finding.

Check Content Reference

M

Target Key

5733