Check the integrity of the audit tools with AIDE

Description

An AIDE rule in /etc/aide/aide.conf.d/70_cirsec_audit_tools covers each audit tool (auditctl, auditd, augenrules, aureport, ausearch, autrace in /usr/sbin/) with permissions, inode, link count, owner, group, size, block count, ACLs, extended attributes and a SHA-512 checksum (p+i+n+u+g+s+b+acl+xattrs+sha512).

The default Debian AIDE configuration already checks /usr/sbin; this rule makes the attributes explicit for the audit tools.

Rationale

The audit tools are the first target of someone who wants to stay hidden. A cryptographic checksum makes a replaced or patched tool show up in the next AIDE check.

Impact

When the file changes and a database already exists, the fix rebuilds the AIDE database, which takes a few minutes and accepts the current state of every file as the new reference.

Setting

Audit

Run grep -h '^/usr/sbin/au' /etc/aide/aide.conf /etc/aide/aide.conf.d/*. Each of auditctl, auditd, augenrules, aureport, ausearch and autrace must have a rule that includes p, i, n, u, g, s, b, acl, xattrs and sha512.

Automated: every check must pass. Scanners report each check by its id.

rules

AIDE rules for the audit tools.

script: |
  [ -d /etc/aide ] || { echo "AIDE is not installed"; exit 1; }
  rc=0
  for t in auditctl auditd augenrules aureport ausearch autrace; do
    a=$(cat /etc/aide/aide.conf /etc/aide/aide.conf.d/* 2>/dev/null | sed -n "s|^/usr/sbin/$t\\\$\{0,1\}[[:space:]]\{1,\}\([^[:space:]]*\).*|\1|p" | tail -n 1)
    for x in p i n u g s b acl xattrs sha512; do
      case "+$a+" in *"+$x+"*) ;; *) echo "$t: ${a:-no rule}"; rc=1; continue 2 ;; esac
    done
  done
  [ "$rc" = 1 ] || echo "all 6 audit tools covered"
  exit "$rc"

Remediation

1. Create /etc/aide/aide.conf.d/70_cirsec_audit_tools with one line per tool:

   /usr/sbin/auditctl$ p+i+n+u+g+s+b+acl+xattrs+sha512
   

   (same for auditd, augenrules, aureport, ausearch and autrace).
2. Run aide --config-check -c /etc/aide/aide.conf, then rebuild the database with aideinit -y -f.

Rollback

Delete /etc/aide/aide.conf.d/70_cirsec_audit_tools and rebuild the database.

aide-rules

[ -d /etc/aide/aide.conf.d ] || { echo "AIDE is not installed" >&2; exit 1; }
f=/etc/aide/aide.conf.d/70_cirsec_audit_tools
t=$(mktemp)
echo '# Written by CIRSEC Baselines CB-DEB-AUDIT-033' >"$t"
for x in auditctl auditd augenrules aureport ausearch autrace; do
  echo "/usr/sbin/$x\$ p+i+n+u+g+s+b+acl+xattrs+sha512" >>"$t"
done
if ! cmp -s "$t" "$f"; then
  cb_backup "$f"
  cat "$t" >"$f"
  chmod 644 "$f"
  aide --config-check -c /etc/aide/aide.conf
  if [ -s /var/lib/aide/aide.db ]; then (umask 027; aideinit -y -f); fi
fi
rm -f "$t"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• aide.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-032 Install the AIDE file integrity checker
• related CB-DEB-AUDIT-011 Install and run the audit daemon

People and lifecycle