Build the AIDE database and check file integrity every day

Description

AIDE needs a reference database, /var/lib/aide/aide.db, built with aideinit from the current state of the system. aide-common then runs a daily check, which compares the files with the database and writes a report to /var/log/aide/ (and mails it when a mail transport is installed):

• from Ubuntu 24.04 (AIDE 0.18 and later), with dailyaidecheck.timer;
• on Ubuntu 20.04 and 22.04 (AIDE 0.16 and 0.17), with the cron job /etc/cron.daily/aide, which CRON_DAILY_RUN=no in /etc/default/aide turns off.

This control requires the database to exist and the daily check to be enabled.

Build the database once the system is in its intended state: run this fix after the other hardening fixes, or rebuild the database afterwards with aideinit -y -f, otherwise the first reports list every change made by the hardening.

Rationale

The database is the trusted reference; the daily check turns it into detection. Without either, an installed AIDE gives a false sense of protection.

Impact

Building the database reads every covered file: a few minutes and a short burst of disk activity. The daily check does the same. After legitimate changes (upgrades, configuration), review the report and update the database (aide --update, then replace aide.db with aide.db.new).

Setting

Audit

1. Run ls -l /var/lib/aide/aide.db. The file must exist and not be empty.
2. Ubuntu 24.04 and later: run systemctl is-enabled dailyaidecheck.timer. It must print enabled. Ubuntu 20.04 and 22.04: /etc/cron.daily/aide must be executable and /etc/default/aide must not set CRON_DAILY_RUN=no.
3. Read the last report in /var/log/aide/ and check that differences are explained.

Automated: every check must pass. Scanners report each check by its id.

database

The AIDE reference database exists.

script: |
  if [ -s /var/lib/aide/aide.db ]; then
    ls -l /var/lib/aide/aide.db
  else
    echo "/var/lib/aide/aide.db missing or empty"
    exit 1
  fi

timer

dailyaidecheck.timer is enabled.

unit: dailyaidecheck.timer
state: enabled

cron

The daily AIDE cron job is present and not turned off (AIDE 0.16 and 0.17).

script: |
  [ -x /etc/cron.daily/aide ] || { echo "/etc/cron.daily/aide missing or not executable"; exit 1; }
  v=$(sed -n 's/^[[:space:]]*CRON_DAILY_RUN=//p' /etc/default/aide 2>/dev/null | tail -n 1 | tr -d "\"'")
  echo "/etc/cron.daily/aide present, CRON_DAILY_RUN=${v:-yes (default)}"
  [ "${v:-yes}" = yes ]

Remediation

1. Run aideinit -y -f and wait for it to finish (a few minutes).
2. Ubuntu 24.04 and later: run systemctl enable --now dailyaidecheck.timer. Ubuntu 20.04 and 22.04: run chmod 755 /etc/cron.daily/aide and set CRON_DAILY_RUN=yes (or remove the line) in /etc/default/aide.

Rollback

Run systemctl disable --now dailyaidecheck.timer (20.04 and 22.04: set CRON_DAILY_RUN=no in /etc/default/aide) and delete /var/lib/aide/aide.db.

database

command -v aideinit >/dev/null 2>&1 || { echo "AIDE is not installed" >&2; exit 1; }
# umask 027: aideinit would otherwise create its logs readable by everyone
[ -s /var/lib/aide/aide.db ] || (umask 027; aideinit -y -f)

timer

Generated from check timer: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cron

[ -f /etc/cron.daily/aide ] || { echo "AIDE is not installed" >&2; exit 1; }
chmod 755 /etc/cron.daily/aide
if grep -Eq '^[[:space:]]*CRON_DAILY_RUN=' /etc/default/aide 2>/dev/null; then
  cb_backup /etc/default/aide
  sed -i 's/^[[:space:]]*CRON_DAILY_RUN=.*/CRON_DAILY_RUN=yes/' /etc/default/aide
fi

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• aideinit(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• systemd.timer(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R76) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-UBU-AUDIT-032 Install the AIDE file integrity checker
• requires CB-UBU-AUDIT-033 Check the integrity of the audit tools with AIDE
• related CB-UBU-AUDIT-035 Keep a protected copy of the AIDE database

People and lifecycle