From Oracle Linux 5 Security Technical Implementation Guide
Part of GEN000140-2
Associated with: CCI-000293
A file integrity baseline is a collection of file metadata which is to evaluate the integrity of the system. A minimal baseline must contain metadata for all device files, setuid files, setgid files, system libraries, system binaries, and system configuration files. The minimal metadata must consist of the mode, owner, group owner, and modification times. For regular files, metadata must also include file size and a cryptographic hash of the file's contents.
Verify a system integrity baseline exists. The Advanced Intrusion Detection Environment (AIDE) tool is included with the operating system. Other host intrusion detection system (HIDS) software is available but must be checked manually.
Procedure:
# grep DBDIR /etc/aide.conf
If /etc/aide.conf does not exist AIDE has not been installed. Unless another HIDS is used on the system, this is a finding.
Examine the response for "database" this indicates the location of the system integrity baseline database used as input to a comparison.
# ls -la
Use AIDE to create a file integrity baseline, including cryptographic hashes, for the system. Configure the /etc/aide.conf file to ensure some form of cryptographic hash (e.g., md5, rmd160, sha256) is used for files. In the default /etc/aide.conf the "NORMAL" or "LSPP" rules which are used for virtually all files DO include some form of cryptographic hash.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer