# Ensure cryptographic mechanisms are used to protect the integrity of audit tools

Necessity: Protecting the integrity of audit tools is critical for maintaining a trustworthy logging and auditing system. Attackers often target audit binaries (e.g., auditd, ausearch, aureport) to disable logging or manipulate logs to conceal their activities. Using a file integrity monitoring tool like AIDE (Advanced Intrusion Detection Environment) establishes a cryptographic baseline of these tools. Any unauthorized modification will be detected during subsequent integrity checks, alerting administrators to a potential compromise. Without this protection, the entire audit trail can be rendered unreliable.

Auditing and Remediation: The audit script verifies that the AIDE package is installed, as it is the standard tool for this function on CentOS. The remediation script handles the installation of AIDE and performs the crucial first step of initializing its database. This creates the secure baseline against which the integrity of specified files, including the audit tools, will be checked.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Installed'. This is a foundational security measure with no practical intermediate state; either integrity is monitored or it is not. The distinction between hardening levels lies not in the installation status but in the subsequent configuration of AIDE—specifically, the comprehensiveness of the file paths it monitors, the frequency of checks, and the secure storage of its baseline database. However, the presence of the tool itself is the non-negotiable prerequisite for all levels of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'aide' package is installed using the system's package manager. The script must output 'Installed' if the package is present and 'Not Installed' otherwise. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single argument, which is expected to be 'install'. The script must use the system's package manager (e.g., 'yum' or 'dnf') to install the 'aide' package. Upon successful installation, it must initialize the AIDE database (e.g., 'aide --init') and move the newly created database to the active location (e.g., 'mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz'). The script must output 'true' on success and 'false' on failure.

