# Ensure filesystem integrity is regularly checked

Necessity: Regularly checking filesystem integrity is a critical security control for detecting unauthorized modifications to the operating system and software. Host-based Intrusion Detection Systems (HIDS) like AIDE create a baseline 'snapshot' of key system files and attributes (permissions, hashes, timestamps) and compare it against the current state. Any unexpected changes can indicate a security breach, malware installation, or unauthorized user activity. Failure to implement this control leaves the system vulnerable to undetected tampering, making it difficult to identify and respond to a compromise.

Auditing and Remediation: The audit script verifies that the AIDE package is installed and that a cron job is configured to execute it periodically, confirming that the file integrity monitoring tool is both present and active. The remediation script automates the full setup process: installing the necessary packages, initializing the baseline integrity database, and creating a daily cron job to ensure that continuous, automated monitoring is established.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Scheduled'. Filesystem integrity monitoring is a foundational security measure, not a tiered one. A system either has this protection actively running or it is significantly more vulnerable. The 'Scheduled' state ensures that AIDE is not only installed but is actively and automatically checking for unauthorized changes. The differentiation in strictness for integrity monitoring typically resides within the AIDE configuration file itself (e.g., which directories are monitored, how frequently checks are run), but the operational status of being scheduled is the essential, non-negotiable requirement for any secure environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Scheduled']` |
| **Moderate** | `['Scheduled']` |
| **Strict** | `['Scheduled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the installation and scheduling of the AIDE (Advanced Intrusion Detection Environment) tool. The script must first verify if the 'aide' package is installed. If it is not, the script must return the string 'Not Installed'. If 'aide' is installed, the script must then check common cron locations (`/etc/crontab`, `/etc/cron.*`, `/var/spool/cron/`) for an entry that executes 'aide'. If a cron job is found, the script should return the string 'Scheduled'. If no cron job is found, it should return 'Not Scheduled'. The output must be one of these exact strings with no additional text.

## Remediation Script Working

Bash script that takes a single positional command-line argument to manage the AIDE filesystem integrity tool. The argument must be the string 'Install and Schedule'. The script must install the 'aide' and 'aide-common' packages if they are not already present, initialize the AIDE database (e.g., by running 'aideinit' and copying the new database to '/var/lib/aide/aide.db'), and create a cron job to run regular checks. The script must be idempotent. Upon successful completion, the script must print the boolean 'true'. If it fails, it must print 'false'.

