# Ensure audit log files mode is configured

Necessity: Audit logs contain sensitive information about system activity, security events, and potential compromises. Protecting these logs is critical to ensure their integrity and confidentiality. Incorrect file permissions could allow unauthorized users to read sensitive data, or worse, modify or delete logs to cover their tracks, thereby undermining forensic investigations and incident response. Enforcing strict file permissions on audit logs is a fundamental security control.

Auditing and Remediation: The audit script inspects the 'auditd.conf' file to verify the configured mode for the 'log_file' parameter. The remediation script directly modifies this configuration file to set the permissions to the desired secure value and restarts the auditd service to ensure the new setting is actively enforced for any new log files created.

Recommended State Rationale:
- Basic ['0640']: This state ensures that only the root user can write to the log files, while a designated administrative group can read them. This is a good baseline for environments where other monitoring services or personnel need read-only access.
- Moderate ['0600']: This state increases security by restricting both read and write access exclusively to the root user. This adheres to the principle of least privilege and prevents any non-root user, even those in administrative groups, from accessing potentially sensitive log data.
- Strict ['0600']: This is the most secure and widely recommended configuration (e.g., by CIS benchmarks). It provides the strongest protection by ensuring that only the root account can access the audit logs, minimizing the risk of unauthorized disclosure or tampering.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0600']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that parses the '/etc/audit/auditd.conf' file to find the value of the 'log_file' parameter. The script must output only the numeric permission value (e.g., '0600') and nothing else. If the parameter is commented out or not present, the script should return an empty string.

## Remediation Script Working

bash script that accepts a single positional argument, which is the desired file mode (e.g., '0600'). The script must locate the 'log_file' parameter in '/etc/audit/auditd.conf', uncomment it if necessary, and set its value to the provided argument. If the parameter does not exist, the script should add 'log_file = <argument>' to the file. After modifying the configuration, the script must restart the auditd service to apply the changes. It should return 'true' on success and 'false' on failure.

