STIGQter STIGQter: STIG Summary: Oracle Linux 5 Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 26 Oct 2018: A file integrity baseline including cryptographic hashes must be created.

DISA Rule

SV-63101r1_rule

Vulnerability Number

V-27250

Group Title

GEN000140-2

Rule Version

GEN000140-2

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Use AIDE to create a file integrity baseline, including cryptographic hashes, for the system.

Configure the /etc/aide.conf file to ensure some form of cryptographic hash (e.g., md5, rmd160, sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.

Check Contents

Verify a system integrity baseline exists. The Advanced Intrusion Detection Environment (AIDE) tool is included with the operating system. Other host intrusion detection system (HIDS) software is available but must be checked manually.

Procedure:
# grep DBDIR /etc/aide.conf

If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding.

Examine the response for "database" this indicates the location of the system integrity baseline database used as input to a comparison.
# ls -la <DBDIR>

If no "database" file as defined in /etc/aide.conf exists a system integrity baseline has not been created, this is a finding.

Examine /etc/aide.conf to ensure some form of cryptographic hash (i.e., md5, rmd160, sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.

If the site has defined rules to replace the functionality provided by the default "NORMAL" and "LSPP" rules but DOES NOT include cryptographic hashes, this is a finding.

Otherwise, if any element used to define the "NORMAL" and "LSPP" rules has been modified resulting in cryptographic hashes not being used, this is a finding.

If any other modification to the default /etc/aide.conf file have been made resulting in rules which do not include cryptographic hashes on appropriate files, this is a finding.

Vulnerability Number

V-27250

Documentable

False

Rule Version

GEN000140-2

Severity Override Guidance

Verify a system integrity baseline exists. The Advanced Intrusion Detection Environment (AIDE) tool is included with the operating system. Other host intrusion detection system (HIDS) software is available but must be checked manually.

Procedure:
# grep DBDIR /etc/aide.conf

If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding.

Examine the response for "database" this indicates the location of the system integrity baseline database used as input to a comparison.
# ls -la <DBDIR>

If no "database" file as defined in /etc/aide.conf exists a system integrity baseline has not been created, this is a finding.

Examine /etc/aide.conf to ensure some form of cryptographic hash (i.e., md5, rmd160, sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.

If the site has defined rules to replace the functionality provided by the default "NORMAL" and "LSPP" rules but DOES NOT include cryptographic hashes, this is a finding.

Otherwise, if any element used to define the "NORMAL" and "LSPP" rules has been modified resulting in cryptographic hashes not being used, this is a finding.

If any other modification to the default /etc/aide.conf file have been made resulting in rules which do not include cryptographic hashes on appropriate files, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

2207

Comments