# Ensure sudo log file exists

Necessity: Maintaining a dedicated log file for sudo activity is a critical security control for accountability and forensics. It provides an immutable record of all commands executed with elevated privileges, which is essential for detecting unauthorized activity, investigating security incidents, and performing compliance audits. Without a sudo log, administrators have no reliable way to track who used privileged access and for what purpose, creating a significant gap in security monitoring.

Auditing and Remediation: The audit script inspects the sudoers configuration files (`/etc/sudoers` and files within `/etc/sudoers.d/`) to determine if a dedicated log file has been specified via the `logfile` directive. The remediation script creates a new configuration file in `/etc/sudoers.d/` to define a specific path for the sudo log, ensuring that all privileged command executions are captured in a single, designated location.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is to configure `/var/log/sudo.log` as the log file. This is a standard, universally recognized location. The distinction between the security levels is not in the log file's path but in how the log data is handled. A Basic setup simply ensures the log exists. A Moderate setup would add requirements for proper file permissions (e.g., 0600, root ownership) and log rotation. A Strict setup mandates that these logs are immediately forwarded to a centralized, write-once, tamper-proof log management system or SIEM for real-time monitoring, alerting, and long-term retention, providing the highest level of security and integrity for the audit trail.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/var/log/sudo.log']` |
| **Moderate** | `['/var/log/sudo.log']` |
| **Strict** | `['/var/log/sudo.log']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that parses the effective sudoers configuration by running `sudo grep -rE '^Defaults\s+logfile' /etc/sudoers /etc/sudoers.d/`. The script should isolate and return only the path of the configured log file (the value after `logfile=`). If no specific log file is configured, the script must return an empty string.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the full path for the sudo log file. The script must create a new configuration file (e.g., `/etc/sudoers.d/99-custom-logfile`) containing the line `Defaults    logfile=<argument_value>`. The script must set the file permissions to 0440 and then use `visudo -c` to validate the entire sudoers configuration. The script shall return `true` on successful creation and validation, and `false` otherwise.

