{
  "id": "CB-UBU-AUDIT-033",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-033",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-033.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-033.yml",
  "profiles_effective": [
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUDIT-033",
    "title": "Check the integrity of the audit tools with AIDE",
    "finding": {
      "title": "A modified audit tool would not be detected",
      "description": "An attacker who replaces auditctl or auditd can hide their activity from the audit log without the change being noticed."
    },
    "status": "active",
    "profiles": [
      "server-hardened",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "aide",
      "auditd",
      "integrity"
    ],
    "description": "An AIDE rule in `/etc/aide/aide.conf.d/70_cirsec_audit_tools` covers each audit tool\n(`auditctl`, `auditd`, `augenrules`, `aureport`, `ausearch`, `autrace` in `/usr/sbin/`) with\npermissions, inode, link count, owner, group, size, block count, ACLs, extended attributes and a\nSHA-512 checksum (`p+i+n+u+g+s+b+acl+xattrs+sha512`).\n",
    "rationale": "The audit tools are the first target of someone who wants to stay hidden. A cryptographic\nchecksum makes a replaced or patched tool show up in the next AIDE check.\n",
    "impact": "When the file changes and a database already exists, the fix rebuilds the AIDE database, which\ntakes a few minutes and accepts the current state of every file as the new reference.\n",
    "notes": "The default Ubuntu AIDE configuration already checks `/usr/sbin`; this rule makes the attributes\nexplicit for the audit tools.\n",
    "setting": {
      "location": "/etc/aide/aide.conf.d/70_cirsec_audit_tools",
      "default_value": "Covered by the generic /usr/sbin rule",
      "recommended_value": "/usr/sbin/<tool>$ p+i+n+u+g+s+b+acl+xattrs+sha512 for each audit tool"
    },
    "audit": {
      "manual": "Run `grep -h '^/usr/sbin/au' /etc/aide/aide.conf /etc/aide/aide.conf.d/*`. Each of auditctl,\nauditd, augenrules, aureport, ausearch and autrace must have a rule that includes\n`p`, `i`, `n`, `u`, `g`, `s`, `b`, `acl`, `xattrs` and `sha512`.\n",
      "checks": [
        {
          "id": "rules",
          "engine": "shell",
          "description": "AIDE rules for the audit tools.",
          "spec": {
            "script": "[ -d /etc/aide ] || { echo \"AIDE is not installed\"; exit 1; }\nrc=0\nfor t in auditctl auditd augenrules aureport ausearch autrace; do\n  a=$(cat /etc/aide/aide.conf /etc/aide/aide.conf.d/* 2>/dev/null | sed -n \"s|^/usr/sbin/$t\\\\\\$\\{0,1\\}[[:space:]]\\{1,\\}\\([^[:space:]]*\\).*|\\1|p\" | tail -n 1)\n  for x in p i n u g s b acl xattrs sha512; do\n    case \"+$a+\" in *\"+$x+\"*) ;; *) echo \"$t: ${a:-no rule}\"; rc=1; continue 2 ;; esac\n  done\ndone\n[ \"$rc\" = 1 ] || echo \"all 6 audit tools covered\"\nexit \"$rc\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Create `/etc/aide/aide.conf.d/70_cirsec_audit_tools` with one line per tool:\n   ```\n   /usr/sbin/auditctl$ p+i+n+u+g+s+b+acl+xattrs+sha512\n   ```\n   (same for auditd, augenrules, aureport, ausearch and autrace).\n2. Run `aide --config-check -c /etc/aide/aide.conf`, then rebuild the database with\n   `aideinit -y -f`.\n",
      "effects": {
        "restart": "none",
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Delete `/etc/aide/aide.conf.d/70_cirsec_audit_tools` and rebuild the database.\n",
      "scripts": [
        {
          "id": "aide-rules",
          "engine": "shell",
          "content": "[ -d /etc/aide/aide.conf.d ] || { echo \"AIDE is not installed\" >&2; exit 1; }\nf=/etc/aide/aide.conf.d/70_cirsec_audit_tools\nt=$(mktemp)\necho '# Written by CIRSEC Baselines CB-UBU-AUDIT-033' >\"$t\"\nfor x in auditctl auditd augenrules aureport ausearch autrace; do\n  echo \"/usr/sbin/$x\\$ p+i+n+u+g+s+b+acl+xattrs+sha512\" >>\"$t\"\ndone\nif ! cmp -s \"$t\" \"$f\"; then\n  cb_backup \"$f\"\n  cat \"$t\" >\"$f\"\n  chmod 644 \"$f\"\n  aide --config-check -c /etc/aide/aide.conf\n  if [ -s /var/lib/aide/aide.db ]; then (umask 027; aideinit -y -f); fi\nfi\nrm -f \"$t\"\n"
        }
      ]
    },
    "references": [
      {
        "title": "aide.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/aide.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R76",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-9(3)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-7(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.012"
      },
      {
        "framework": "cwe",
        "id": "CWE-353"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-AUDIT-032",
        "type": "requires"
      },
      {
        "id": "CB-UBU-AUDIT-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fails before the rule file; fix writes 70_cirsec_audit_tools, aide --config-check OK, rule present in aide.conf.autogenerated; passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fails before the rule file; fix writes 70_cirsec_audit_tools, aide --config-check OK; passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fails before the rule file; fix writes 70_cirsec_audit_tools, aide --config-check OK; passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fails before the rule file; fix writes 70_cirsec_audit_tools, aide --config-check OK; passes after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}