# Ensure login and logout events are collected

Necessity: Monitoring login and logout events is a fundamental aspect of system security. These audit rules track access to files that record user login information (`lastlog`), failed login attempts (`faillog`), and lockout tallies (`tallylog`). This data is critical for detecting unauthorized access attempts, performing forensic analysis after a security incident, and ensuring user accountability. A failure to collect these events creates a significant blind spot, hindering the ability to identify and respond to malicious activity. Auditing and Remediation: The audit script inspects the active auditd rule set to verify that watches are in place for the specified log files. The remediation script ensures these rules are formally defined in the auditd rules directory and reloads the audit service to make them active, thereby enabling the collection of access records for these critical files. Recommended State Rationale: Basic, Moderate, and Strict are all set to 'Present' because this is a foundational binary control—it is either enabled or it is not. There is no intermediate state. Basic security requires this level of auditing to establish a baseline for monitoring. For Moderate and Strict levels, this control remains essential and is non-negotiable for any secure system. Its presence is mandated by numerous security frameworks, including the CIS Benchmarks, as a minimum requirement for system accountability and traceability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if auditd rules are configured to watch the files `/var/log/faillog`, `/var/log/lastlog`, and `/var/log/tallylog` for write and attribute change access (`-p wa`). The script must query the currently loaded rules using `auditctl -l`. If all three rules are present, the script must output only the string 'Present'. Otherwise, it must output only the string 'Not Present'. There should be no additional text or formatting in the output.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state, which should be 'Present'. If the argument is 'Present', the script must create or update an auditd rules file (e.g., `/etc/audit/rules.d/logins.rules`) with the following content: `-w /var/log/faillog -p wa -k logins`, `-w /var/log/lastlog -p wa -k logins`, and `-w /var/log/tallylog -p wa -k logins`. After writing the file, the script must run `augenrules --load` to apply the new configuration. The script must return only `true` on successful application of the rules, or `false` on failure.

