# Ensure auditd packages are installed

Necessity: The Linux Audit Daemon (auditd) is the userspace component of the Linux Auditing System. It is crucial for security as it collects and records detailed information about security-relevant events on the system, such as file access, system calls, and user commands. This provides a trail for forensic analysis, intrusion detection, and compliance verification. Without auditd, a system lacks the ability to create a detailed, kernel-level log of activities, significantly hindering the ability to investigate security incidents or prove compliance with security policies. The 'audispd-plugins' package provides additional plugins for real-time event processing. Auditing and Remediation: The audit script verifies that the 'auditd' and 'audispd-plugins' packages are properly installed, confirming that the system's auditing capabilities are available. The remediation script uses the system's package manager to install these packages if they are found to be missing, thereby enabling the system's core auditing functionality. Recommended State Rationale: For this control, the recommended state is binary; the packages are either installed or they are not. Therefore, the 'Installed' state is required for all security levels. Basic: Installation is the minimum requirement for any level of system auditing. Without the packages, no auditing can be configured or enabled. Moderate: A moderately hardened system must have auditd installed to meet standard security benchmarks and enable effective monitoring. Strict: For a strictly hardened system, having auditd installed is non-negotiable. It is a foundational component for ensuring accountability, non-repudiation, and deep system visibility, which are essential in high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the 'auditd' and 'audispd-plugins' packages are installed using the 'dpkg-query' command. The script must return the string 'Installed' if both packages are present and correctly installed. Otherwise, it must return 'Not Installed'. The output must only contain the resulting string and no other text.

## Remediation Script Working

bash script that accepts a single argument, which should be the desired state ('Install'). The script must use 'apt-get install -y auditd audispd-plugins' to install the packages. The script must return 'true' if the packages are successfully installed or already present, and 'false' if the installation fails.

