Build the AIDE database and check file integrity every day

Description

AIDE needs a reference database, /var/lib/aide/aide.db, built with aideinit from the current state of the system. aide-common then ships dailyaidecheck.timer, which compares the files with the database once a day and writes a report to /var/log/aide/ (and mails it when a mail transport is installed).

This control requires the database to exist and the timer to be enabled.

Build the database once the system is in its intended state: run this fix after the other hardening fixes, or rebuild the database afterwards with aideinit -y -f, otherwise the first reports list every change made by the hardening.

Rationale

The database is the trusted reference; the daily check turns it into detection. Without either, an installed AIDE gives a false sense of protection.

Impact

Building the database reads every covered file: a few minutes and a short burst of disk activity. The daily check does the same. After legitimate changes (upgrades, configuration), review the report and update the database (aide --update, then replace aide.db with aide.db.new).

Setting

Audit

1. Run ls -l /var/lib/aide/aide.db. The file must exist and not be empty.
2. Run systemctl is-enabled dailyaidecheck.timer. It must print enabled.
3. Read the last report in /var/log/aide/ and check that differences are explained.

Automated: every check must pass. Scanners report each check by its id.

database

The AIDE reference database exists.

script: |
  if [ -s /var/lib/aide/aide.db ]; then
    ls -l /var/lib/aide/aide.db
  else
    echo "/var/lib/aide/aide.db missing or empty"
    exit 1
  fi

timer

dailyaidecheck.timer is enabled.

unit: dailyaidecheck.timer
state: enabled

Remediation

1. Run aideinit -y -f and wait for it to finish (a few minutes).
2. Run systemctl enable --now dailyaidecheck.timer.

Rollback

Run systemctl disable --now dailyaidecheck.timer and delete /var/lib/aide/aide.db.

database

command -v aideinit >/dev/null 2>&1 || { echo "AIDE is not installed" >&2; exit 1; }
# umask 027: aideinit would otherwise create its logs readable by everyone
[ -s /var/lib/aide/aide.db ] || (umask 027; aideinit -y -f)

timer

Generated from check timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• aideinit(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemd.timer(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R76) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-032 Install the AIDE file integrity checker
• requires CB-DEB-AUDIT-033 Check the integrity of the audit tools with AIDE
• related CB-DEB-AUDIT-035 Keep a protected copy of the AIDE database

People and lifecycle