# Ensure successful and unsuccessful attempts to use the usermod command are collected

The 'usermod' command is a critical utility used to modify user account information, such as group memberships, UID, GID, home directory, and login shell. Unauthorized or malicious use of this command can lead to privilege escalation, unauthorized access, or misconfiguration of user accounts. Ensuring that all uses of 'usermod', both successful and unsuccessful, are logged is essential for security monitoring, incident response, and forensic analysis. It provides an immutable audit trail to detect and investigate suspicious account modifications.

The audit script verifies if the 'auditd' service is configured to log execution attempts of '/usr/sbin/usermod'. The remediation script adds or removes this specific audit rule from the system's persistent auditd configuration and reloads the rules to make the change effective.

All recommended states (Basic, Moderate, and Strict) mandate that this audit rule be 'present'. There is no acceptable level of security where modifications to user accounts are not logged. This is a foundational security control, and its absence creates a critical visibility gap. This recommendation aligns with security benchmarks like CIS, which require auditing of commands that modify user and group information.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the loaded auditd rules for a rule that watches the '/usr/sbin/usermod' command for write and attribute change permissions. The script should search for the pattern '-w /usr/sbin/usermod -p wa'. If the rule is found, the script must output 'present'; otherwise, it must output 'absent'. The output must not contain any other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'present' or 'absent'. If the argument is 'present', the script must add the rule '-w /usr/sbin/usermod -p wa -k usermod' to the '/etc/audit/rules.d/audit.rules' file (or an equivalent persistent rule file) if it does not already exist, and then run 'augenrules --load' to apply the changes. If the argument is 'absent', it must remove the rule. The script must return 'true' on successful application of the state or if the state is already compliant, and 'false' on failure.

