Keep a protected copy of the AIDE database

Description

The AIDE database (/var/lib/aide/aide.db) and its configuration are the reference of the integrity check. A copy must be kept where the system cannot write: read-only media, a backup server, or an integrity platform that pulls it. Checks should be run against that copy, or the local database compared with it, and its own checksum recorded.

Rationale

An integrity check is only as trustworthy as its reference. A database that root can rewrite does not resist an attacker who already has root.

Impact

Every legitimate update of the database (after upgrades) must also update the protected copy.

Audit

1. Find where the protected copy of /var/lib/aide/aide.db is kept, and check that the system cannot modify it.
2. Compare it with the local database: sha512sum /var/lib/aide/aide.db must match the checksum recorded with the copy, unless a reviewed update has been made since.

Remediation

1. After each reviewed database build or update, copy /var/lib/aide/aide.db and /etc/aide/ to a read-only medium or a backup server the system cannot write to, and record sha512sum /var/lib/aide/aide.db with it.
2. For a trusted check, run AIDE from the copy, for example aide --check -c /etc/aide/aide.conf -B 'database_in=file:/mnt/ro/aide.db'.

Rollback

Not applicable.

References

• aide.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R77) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-034 Build the AIDE database and check file integrity every day

People and lifecycle