# Ensure auditd service is enabled and active

Necessity: The auditd service is the user-space component of the Linux Auditing System. It is crucial for collecting detailed, non-repudiable logs of security-relevant events on the system, such as file access, system calls, and authentication attempts. Disabling auditd eliminates the system's ability to create a forensic trail, making it nearly impossible to detect unauthorized activity, investigate security incidents, or comply with regulatory standards. An attacker could compromise the system and erase their tracks without a record of their actions.

Auditing and Remediation: The audit script verifies the current startup policy for the auditd service using `systemctl is-enabled`. This command checks if the service is configured to start automatically on system boot. The remediation script ensures the service is not masked (which would prevent it from starting), enables it for auto-start, and starts it in the current session using `systemctl --now enable`.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'enabled'. For this control, the state is binary; the service must be running to provide any security value. There is no 'less secure' enabled state. The granularity of security (Basic, Moderate, Strict) is determined by the specific audit *rules* configured within auditd, not by the service's operational status. Therefore, ensuring the service is enabled is the foundational requirement for all levels of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `systemctl is-enabled auditd` command to check the status of the auditd service. The script must output only the raw status value (e.g., 'enabled', 'disabled') without any additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument representing the desired state (e.g., 'enabled'). The script should use `systemctl unmask auditd` followed by `systemctl --now enable auditd` to set the service state. It must return 'true' if the operation is successful and 'false' if it fails.

