# Ensure AIDE is installed

Necessity: AIDE (Advanced Intrusion Detection Environment) is a crucial host-based intrusion detection system (HIDS) that functions as a file and directory integrity checker. It creates a database of file attributes (permissions, inode, hash, etc.) and compares it against the current state of the system to detect unauthorized modifications. This is critical for identifying potential security breaches, such as the installation of rootkits, malware, or unauthorized changes to critical system or configuration files. Failing to have AIDE installed removes a fundamental layer of defense, leaving the system vulnerable to undetected tampering.

Auditing and Remediation: The audit script verifies whether the 'aide' package is present on the system, providing a simple 'Installed' or 'Not Installed' status. The remediation script directly addresses this state by either installing the 'aide' and 'aide-common' packages using the system's package manager or removing them, based on the provided command-line argument.

Recommended State Rationale: 
Basic: ['Installed'] - The basic recommendation is to have AIDE installed. This is a foundational security practice and a requirement for many compliance frameworks (e.g., CIS Benchmarks, PCI DSS) that mandate file integrity monitoring.
Moderate: ['Installed'] - For a moderate security posture, AIDE must be installed. The distinction for this level would be found in the subsequent configuration of AIDE, such as ensuring its database is initialized and regular checks are scheduled.
Strict: ['Installed'] - In a strict security environment, the presence of AIDE is non-negotiable. For a setting of this type (package installation), the recommended state does not change between levels. The stringency is applied to AIDE's configuration, rules, and the response protocol when integrity violations are detected.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the 'aide' package is installed using `dpkg-query`. The script should output 'Installed' if the package is installed and 'Not Installed' if it is not. The output must not contain any other text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument: 'Installed' or 'Not Installed'. If the argument is 'Installed', the script must install the 'aide' and 'aide-common' packages using `apt-get install -y`. If the argument is 'Not Installed', it must remove them. The script must output `true` upon successful completion of the action or `false` if the action fails.

