RHEL 9 must have the AIDE package installed.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-258134	SRG-OS-000363-GPOS-00150	RHEL-09-651010	SV-258134r1155620_rule	2025-11-24	2

Description
Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Selection lines in the aide.conf file determine which files and directories AIDE will monitor for changes. They follow this format: <path> <rules> The <path> specifies a file, directory or wildcard pattern to monitor. The <rules>define which attributes (hashes, permissions, timestamps, etc.) to check. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199

Description

Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Selection lines in the aide.conf file determine which files and directories AIDE will monitor for changes. They follow this format: <path> <rules> The <path> specifies a file, directory or wildcard pattern to monitor. The <rules>define which attributes (hashes, permissions, timestamps, etc.) to check. Satisfies: SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199

ℹ️ Check
Verify the file integrity tool is configured to verify ACLs. Note: AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. Verify AIDE is installed with the following command: $ sudo dnf list installed aide Updating Subscription Management repositories. Installed Packages aide.x86_64 0.16-103.el9 @rhel-9-for-x86_64-appstream-rpms Use the following command to determine if the file is in a location other than "/etc/aide/aide.conf": $ sudo find / -name aide.conf If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system.

ℹ️ Check

Verify the file integrity tool is configured to verify ACLs. Note: AIDE is highly configurable at install time. This requirement assumes the "aide.conf" file is under the "/etc" directory. Verify AIDE is installed with the following command: $ sudo dnf list installed aide Updating Subscription Management repositories. Installed Packages aide.x86_64 0.16-103.el9 @rhel-9-for-x86_64-appstream-rpms Use the following command to determine if the file is in a location other than "/etc/aide/aide.conf": $ sudo find / -name aide.conf If AIDE is not installed, ask the system administrator (SA) how file integrity checks are performed on the system.

✔️ Fix
Install AIDE, initialize it, and perform a manual check. Install AIDE: $ sudo dnf install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2023-06-05 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2023-06-05 10:09:57 -0600 (run time: 0m 53s) The new database will need to be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!! ...

✔️ Fix

Install AIDE, initialize it, and perform a manual check. Install AIDE: $ sudo dnf install aide Initialize AIDE: $ sudo /usr/sbin/aide --init Example output: Start timestamp: 2023-06-05 10:09:04 -0600 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 86833 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz MD5 : coZUtPHhoFoeD7+k54fUvQ== SHA1 : DVpOEMWJwo0uPgrKZAygIUgSxeM= SHA256 : EQiZH0XNEk001tcDmJa+5STFEjDb4MPE TGdBJ/uvZKc= SHA512 : 86KUqw++PZhoPK0SZvT3zuFq9yu9nnPP toei0nENVELJ1LPurjoMlRig6q69VR8l +44EwO9eYyy9nnbzQsfG1g== End timestamp: 2023-06-05 10:09:57 -0600 (run time: 0m 53s) The new database will need to be renamed to be read by AIDE: $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz Perform a manual check: $ sudo /usr/sbin/aide --check Example output: 2023-06-05 10:16:08 -0600 (AIDE 0.16) AIDE found NO differences between database and filesystem. Looks okay!! ...