# Ensure events that modify the sudo log file are collected

Necessity: The sudo log file (/var/log/sudo.log or equivalent) records all commands executed with elevated privileges. Attackers who gain root access often attempt to modify or delete this file to erase evidence of their activities. Monitoring for any write or attribute modification events provides a critical, real-time alert that the integrity of the system's most important audit trail is being compromised. Failure to collect these events creates a significant gap in security monitoring and forensic capabilities, allowing an attacker to operate with impunity.

Auditing and Remediation: The audit script inspects the currently loaded kernel audit rules to verify that a rule is in place to watch the sudo log file for write and attribute change ('wa') events. The remediation script ensures this rule is present and persistent by adding '-w /var/log/sudo.log -p wa -k sudo_log_file' to the auditd rules configuration, making sure that any attempt to tamper with the log is recorded by the system.

Recommended State Rationale:
- Basic: ['Enabled']. This is the minimum required state for any system. The integrity of privilege escalation logs is a fundamental security control.
- Moderate: ['Enabled']. There is no effective intermediate state for this control. The log is either monitored for tampering or it is not. Therefore, the moderate state is identical to the basic state.
- Strict: ['Enabled']. For high-security environments, the non-negotiable integrity of audit trails is paramount. This rule must be enabled to ensure any attempts to cover tracks by modifying logs are immediately captured, providing an essential layer of defense and accountability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that queries the active auditd rules using 'auditctl -l' and checks for a rule that monitors write and attribute changes to the sudo log file. The rule should match the pattern: -w /var/log/sudo.log -p wa. If a matching rule is found, the script must output only the string 'Enabled'; otherwise, it must output only 'Disabled'.

## Remediation Script Working

shell script that accepts a single positional argument, which must be either 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the rule '-w /var/log/sudo.log -p wa -k sudo_log_file' to a persistent auditd rules file (e.g., /etc/audit/rules.d/50-sudo.rules), ensuring it is not a duplicate, and then reload the rules. If the argument is 'Disabled', it must remove the rule. The script must return 'true' upon successful application of the state or if the state is already compliant, and 'false' on failure.

