# Ensure audit tools mode is configured

Necessity: The audit daemon mode determines the operational state of the system's auditing capabilities. A mode of '0' disables auditing entirely, creating a significant security blind spot. A mode of '1' enables logging, which is the minimum requirement for security monitoring and incident response. A mode of '2' makes the audit configuration immutable, preventing even privileged users or attackers who gain root access from disabling the audit trail without a system reboot. Misconfiguration can lead to a complete loss of forensic data or allow an attacker to operate undetected. Auditing and Remediation: The audit script checks the live runtime mode of the auditd service using 'auditctl'. The remediation script modifies the persistent rule files to ensure the desired mode is loaded at boot and upon rule reloads, providing a durable configuration. Recommended State Rationale: Basic/Moderate: A recommended state of '1' (Log) ensures that the auditd service is active and recording events as defined in its ruleset. This is the standard operational mode and is fundamental for any level of system security monitoring. Strict: A recommended state of '2' (Immutable/Panic) provides the highest level of assurance for the audit trail. By making the rules immutable, it prevents tampering with the logging configuration. This is critical in high-security environments where the integrity and availability of audit logs are paramount for compliance and forensic investigations, as it forces a system reboot to alter the logging rules, an action which is itself an auditable event.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['2']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the 'auditctl -s' command to retrieve the current status of the audit daemon. The script must parse this output to isolate and return only the numerical value for the 'mode' (e.g., '1'), ensuring no other text or formatting is included in the output.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which is the desired audit mode ('0', '1', or '2'). The script must modify the main audit rules file (commonly '/etc/audit/rules.d/audit.rules') to set the configuration flag '-e' to the provided value. If the '-e' flag already exists, its value should be updated; if it does not exist, it should be added to the file. After modifying the file, the script must execute 'augenrules --load' to apply the changes. The script must output 'true' on successful application of the rule and 'false' on failure.

