Install the AIDE file integrity checker

Description

AIDE (Advanced Intrusion Detection Environment) records the checksums and attributes of system files in a database, then compares the files with it. Debian splits it into aide (the program) and aide-common (configuration in /etc/aide/, aideinit, daily check). Neither is installed by default.

The fix installs without recommended packages: aide recommends a mail transport agent, which apt-get would otherwise install (exim4). Reports of the daily check are written to /var/log/aide/; install and configure a mail transport if they must be mailed.

Rationale

An integrity checker is the simplest way to detect that files which should never change (binaries, libraries, configuration) have been modified, whether by an intruder or by mistake.

Impact

Installing AIDE alone does nothing until its database is built (CB-DEB-AUDIT-034).

Setting

Audit

Run dpkg-query -W -f='${Package} ${Status}\n' aide aide-common. Both must end with installed.

Automated: every check must pass. Scanners report each check by its id.

aide

aide is installed.

name: aide
state: installed

aide-common

aide-common is installed.

name: aide-common
state: installed

Remediation

Run apt-get install --no-install-recommends aide aide-common.

Rollback

Run apt-get purge aide aide-common.

install

DEBIAN_FRONTEND=noninteractive apt-get install -y -q --no-install-recommends aide aide-common

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• aide(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R76) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-034 Build the AIDE database and check file integrity every day

People and lifecycle