# Ensure session initiation information is collected

Necessity: Collecting session initiation information is critical for maintaining accountability and enabling forensic investigations. The auditd service logs all attempts to start a user session by monitoring files like utmp, wtmp, and btmp. This creates an audit trail that can be used to track user activity, identify unauthorized access attempts, and investigate security incidents after they occur. Failure to collect this information creates a significant blind spot, making it difficult to determine who was on the system and when, which is a major compliance and security risk.

Auditing and Remediation: The audit script verifies that the auditd service is configured with the correct rules to watch key session-related files for write and attribute change events. The remediation script ensures these specific rules are added to the auditd rule set, typically in a file like '/etc/audit/rules.d/50-logins.rules', and then reloads the audit daemon to apply them immediately.

Recommended State Rationale: This is a foundational security setting with no acceptable less-secure alternative. Therefore, the recommended state for Basic, Moderate, and Strict hardening levels is 'Present'.
- Basic: At a minimum, all session initiation events must be logged to establish a baseline of user accountability.
- Moderate: This baseline remains essential. There is no intermediate state; logging must be fully enabled.
- Strict: In a high-security environment, complete and non-repudiable logs of all session activity are mandatory. This control is not optional and underpins many other security monitoring processes.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for collecting session initiation information are present and active. The script should query the loaded auditd rules for watches on '/var/run/utmp', '/var/log/wtmp', '/var/log/btmp', and '/var/log/lastlog'. The script must output a single value: 'Present' if all rules are correctly configured, or 'Absent' if one or more are missing. The output must not contain any other text.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'Present'. When executed with this argument, the script must add the following lines to a new or existing audit rule file in '/etc/audit/rules.d/': '-w /var/run/utmp -p wa -k session', '-w /var/log/wtmp -p wa -k logins', '-w /var/log/btmp -p wa -k logins', '-w /var/log/lastlog -p wa -k logins'. After adding the rules, the script must ensure they are loaded into the running configuration. The script must return 'true' on success and 'false' on failure.

