I'm not sure if this is the place to talk about the specific content of
the security standards or if the SSG is more "meta"...
I see there is a test Rule ID: *package_aide_installed. *I am inclined
to think that the spirit of this test is to have a file integrity
monitoring (FIM) system. But why AIDE specifically? There are a few
options for FIM, but not too many that one couldn't write tests to
ensure that at least one of the handful of fully featured OSS FIM
solutions is installed and configured. (other options that come to mind
are OSSEC and Samhain) Additionally, AIDE development seems to be
stagnant and perhaps not the best choice at this time.
Where is this guidance coming from? Is the source of the guidance really
technology specific or is the choice of AIDE just a specific
interpretation of a more general guidance for a FIM solution? What's the
rationale, if so?
-Bond