# Ensure changes to system administration scope (sudoers) is collected

Necessity: The `/etc/sudoers` file and the `/etc/sudoers.d` directory define which users and groups are granted administrative (root) privileges. Unauthorized modification of these files is a primary method for privilege escalation, allowing an attacker to gain complete control over a system. Monitoring for any changes is critical for detecting and investigating potential security breaches or unauthorized administrative actions. Failure to collect these audit events creates a significant blind spot in system security.

Auditing and Remediation: The audit script verifies that the Linux Auditing System (`auditd`) is configured to watch the `sudoers` file and directory. It checks for rules that log write access (`w`) and attribute changes (`p`) and assigns a unique key (`k=scope`) for easy identification in the logs. The remediation script adds these precise rules to the auditd configuration, ensuring that any modifications are permanently logged for security review.

Recommended State Rationale: 
Basic, Moderate, and Strict: All security levels recommend this state be 'Enabled'. There is no acceptable level of risk that justifies not monitoring changes to administrative privilege configurations. This is a foundational security control. For Basic systems, it provides essential detection capabilities. For Moderate and Strict systems, it is an absolute requirement for maintaining system integrity and compliance with security frameworks like CIS Benchmarks, which mandate logging changes to security scope.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for monitoring `/etc/sudoers` and `/etc/sudoers.d` for write and attribute changes with the key 'scope' are active. The script must query the loaded audit rules and output 'Enabled' if rules containing '-w /etc/sudoers -p wa -k scope' and '-w /etc/sudoers.d -p wa -k scope' exist, and 'Disabled' otherwise. The output must only be the resulting string value.

## Remediation Script Working

Bash script that accepts one positional argument ('Enabled' or 'Disabled'). If the argument is 'Enabled', the script must add the rules `-w /etc/sudoers -p wa -k scope` and `-w /etc/sudoers.d -p wa -k scope` to a persistent audit rules file (e.g., `/etc/audit/rules.d/scope.rules`). If 'Disabled', it must remove these specific rules. The script must return `true` on success and `false` on failure.

