# Ensure filesystem integrity is regularly checked

Necessity: Regularly checking filesystem integrity is a critical security practice for detecting unauthorized modifications to system files. Host-based Intrusion Detection Systems (HIDS) like AIDE (Advanced Intrusion Detection Environment) create a baseline database of file hashes, permissions, and other attributes. Regular checks against this baseline can reveal changes made by malware, rootkits, or unauthorized users, providing an essential layer of defense for identifying a system compromise. Failure to perform these checks leaves the system vulnerable to undetected, persistent threats.

Auditing and Remediation: The audit script verifies that the AIDE package is installed and that a cron job is scheduled to run integrity checks automatically. The remediation script installs AIDE if necessary, initializes its database, and creates a daily cron job to ensure these checks are performed consistently, thereby enabling automated filesystem integrity monitoring.

Recommended State Rationale: 
- Basic: ['Enabled']. The fundamental requirement for any secure system is to have automated integrity checking active. This represents the minimum acceptable configuration for detecting unauthorized changes.
- Moderate: ['Enabled']. For a moderately hardened system, continuous and automated integrity monitoring remains a non-negotiable baseline. There is no intermediate state; it is either on or off.
- Strict: ['Enabled']. In a strictly hardened environment, filesystem integrity monitoring is an indispensable control. It serves as a last line of defense to detect a breach that has bypassed other preventative controls. Disabling this feature is unacceptable in any high-security context.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks for a cron job configured to run `aide --check` or a similar AIDE check command on a regular basis (e.g., in `/etc/cron.daily`, `/etc/cron.weekly`, or the root crontab). The script should also verify that the AIDE package is installed. If AIDE is installed and a valid cron job is found, the script must return 'Enabled'. Otherwise, it must return 'Disabled'.

## Remediation Script Working

shell script that accepts one argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must first ensure the AIDE package is installed, initialize an AIDE database if one doesn't exist (`aide --init`), and then create a cron job (e.g., as a file in `/etc/cron.daily/`) to execute `aide --check` regularly. If the argument is 'Disabled', it must remove any existing AIDE check cron job. The script must return `true` on success and `false` on failure.

