Build and Test AIDE Database
Ensures AIDE is installed and that an initial integrity database exists under /var/lib/aide/aide.db*.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
AIDE (Advanced Intrusion Detection Environment) detects unauthorized changes to files by comparing the current state against a baseline. That baseline is only useful if a "known-good" database has actually been built from a trusted installation. Without an initialized database, AIDE cannot tell whether a binary, config or library was tampered with, silently providing no protection.
What Pavois checks
Pavois confirms the aide binary is on PATH and that an aide.db* file is present in /var/lib/aide/. It checks the actual on-disk database rather than just the package state, because a package can be installed without the database ever having been initialized, the effective protective artifact is the database file itself.
describe command('command -v aide >/dev/null 2>&1 && ls /var/lib/aide/aide.db* >/dev/null 2>&1 && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run command -v aide && ls -l /var/lib/aide/aide.db*. Expect the binary path plus a non-empty database file. A manual check with aide --check (RHEL) or aide.wrapper --check (Debian) should report no unexpected changes on a clean system.
Inspect & investigate
AIDE run results are written to /var/log/aide/aide.log (Debian) or to the report path in /etc/aide.conf, and often mailed to root. Confirm the package with dpkg -l aide / rpm -q aide, and the database file with ls -l /var/lib/aide/aide.db*.
Remediation
No automated harden plan ships for this rule; apply it manually. Install AIDE (apt install aide / dnf install aide), then initialize the baseline: on Debian/Ubuntu aideinit (writes aide.db.new, which you move to aide.db); on RHEL aide --init then mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz. Build the baseline only on a trusted, freshly installed system.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | aideinit -y -f >/dev/null 2>&1 || aide --init; mv -f /var/lib/aide/aide.db.new /var/lib/aide/aide.db 2>/dev/null || true |
|---|---|
| name | aide-build-database |
| not_if | ls /var/lib/aide/aide.db >/dev/null 2>&1 |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
The critical precaution is trust of the baseline: if you initialize the database on an already-compromised host, AIDE will treat the attacker's files as known-good and never flag them. Build it before exposing the machine to the network. Operationally, the initial scan is I/O heavy and can take minutes on large filesystems, and you must rebuild the database (aide --update) after every legitimate change (package updates, config edits) or you will drown in false positives.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R76 | direct | 2.0 | high |
| CIS | 11.5.2, 6.3.1, 6.1.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 11.5.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-651015, UBTU-24-100110 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.