Ensure filesystem integrity is regularly checked

How it is checked

Audit method: Shell command

e=$(systemctl is-enabled aidecheck.timer 2>/dev/null)
[ "$e" = enabled ] && systemctl is-active --quiet aidecheck.timer && { echo compliant; exit 0; }
c=$( (crontab -u root -l 2>/dev/null; cat /etc/crontab /etc/cron.d/* 2>/dev/null; ls /etc/cron.daily /etc/cron.weekly 2>/dev/null) | grep -E '(^|[^#].*)\baide' )
[ -n "$c" ] && echo compliant || echo 'no aidecheck.timer or aide cron job'

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands: # cp ./config/aidecheck.service /etc/systemd/system/aidecheck.service # cp ./config/aidecheck.timer /etc/systemd/system/aidecheck.timer # chmod 0644 /etc/systemd/system/aidecheck.* # systemctl reenable aidecheck.timer # systemctl restart aidecheck.timer # systemctl daemon-reload OR Run the following command: # crontab -u root -e Add the following line to the crontab: 0 5 * * * /usr/bin/aide.wrapper --config /etc/aide/aide.conf --check

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target ros