A file integrity tool is installed
Requires that a file integrity / host monitoring tool, aide, tripwire, or AppArmor (aa-status), is present so unexpected changes to critical files can be detected.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Attackers who gain a foothold routinely modify or replace system binaries and configuration files (backdoored sshd, altered cron jobs, tampered libraries). A File Integrity Monitoring tool keeps a cryptographic baseline of critical files and flags any deviation, giving you a reliable signal of compromise or unauthorised change. Without one, such tampering can go unnoticed for a long time.
What Pavois checks
Pavois checks the effective state by testing whether any of aide, tripwire or aa-status is actually present on PATH (command -v), not just whether a package line exists somewhere. This reflects what the running system can really do rather than what a manifest claims.
describe command('command -v aide >/dev/null 2>&1 || command -v tripwire >/dev/null 2>&1 && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run command -v aide tripwire aa-status, at least one path should be returned. For AIDE you can further confirm a baseline exists with aide --check (after aide --init); for AppArmor, aa-status should list loaded profiles.
Inspect & investigate
AIDE reports go to its log (commonly /var/log/aide/aide.log) and to email/cron output when run on a schedule. AppArmor denials appear in the kernel log via journalctl -k | grep apparmor (or dmesg). Package presence can be confirmed with dpkg -l aide / rpm -q aide.
Remediation
No automated remediation is shipped, so apply it manually: install AIDE (apt install aide / dnf install aide), initialise the database (aideinit or aide --init, then move the new DB into place), and schedule a periodic aide --check. AppArmor is enabled by default on Debian/Ubuntu and already satisfies this check.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | aide-common |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing a FIM tool is non-disruptive. The practical considerations are operational: AIDE's initial database must be built on a known-good system (do it right after install, before exposing the host) and re-baselined after every legitimate change (updates, deployments), otherwise it produces noise. AppArmor in enforce mode can block applications with missing profiles, review denials before tightening profiles.