Install AIDE
Ensures the AIDE (Advanced Intrusion Detection Environment) package is installed so the host can perform file integrity monitoring.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
AIDE maintains a cryptographic baseline of critical files (binaries, libraries, configuration) and reports any unauthorized change. Without it installed, no host-based integrity check exists, so an attacker who tampers with /etc, system binaries, or implants a rootkit can do so undetected. File integrity monitoring is a core defense-in-depth control and a requirement of CIS, ANSSI BP-028 (R76) and PCI-DSS 11.5.
What Pavois checks
Pavois asks the package manager whether aide is installed via the InSpec package resource (resolving to dpkg/rpm underneath). This queries the effective package database, not a guessed path, so it stays correct whether AIDE was installed from the distro repo or a meta-package.
describe package('aide-common') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s aide on Debian/Ubuntu or rpm -q aide on RHEL-family. Expected output shows the package present (Status: install ok installed or a version string like aide-0.16-...).
Inspect & investigate
dpkg -l aide/rpm -q aideconfirm installation.- AIDE runs typically log to
/var/log/aide/aide.logand a daily cron/systemd timer (aidecheck.timer) emails or journals integrity diffs; checkjournalctl -u dailyaidecheck.serviceorjournalctl -u aidecheck.service.
Remediation
Pavois's harden plan installs the aide package (package resource, install action) when you run pavois harden apply. Note that installation alone does not build the integrity database: initialize it afterwards with aideinit (Debian/Ubuntu) or aide --init (RHEL) and schedule periodic checks.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | aide-common |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing AIDE is low-risk: it adds a tool without altering running services. The real operational cost comes later, the first aide --init is I/O intensive and the baseline must be regenerated after every legitimate change (package updates, config edits), otherwise daily reports flood with false positives. Store the database and config on read-only or off-host media so an intruder cannot rewrite the baseline.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R76 | direct | 2.0 | high |
| CIS | 11.5.2, 6.3.1, 6.1.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 11.5.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-651010, UBTU-24-100100 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.