# Ensure changes to system administration scope (sudoers) is collected

Necessity: The `/etc/sudoers` file and the `/etc/sudoers.d/` directory are critical system files that define which users and groups are granted administrative privileges. Unauthorized modification of these files can lead to immediate and complete system compromise through privilege escalation. Collecting audit events for any changes to this scope is essential for detecting potential security breaches, unauthorized access attempts, or administrative mistakes. Failure to monitor these files leaves a significant gap in security visibility, allowing an attacker to gain persistent root access undetected. 

Auditing and Remediation: The audit script inspects the currently loaded `auditd` rules to verify that a watch is set on `/etc/sudoers` and `/etc/sudoers.d/` for write and attribute change events. The remediation script adds the necessary rules to the persistent audit configuration directory (`/etc/audit/rules.d/`) and then reloads the `auditd` service to apply them immediately, ensuring that monitoring begins and persists across reboots. 

Recommended State Rationale: 
- Basic: ['Enabled']. This is the minimum acceptable state. Any secure system must monitor for changes to administrative privileges. Not enabling this rule constitutes a critical security flaw. 
- Moderate: ['Enabled']. For this specific control, there is no meaningful state between 'Enabled' and 'Disabled'. The moderate security posture requires this rule to be active, just as the basic one does. 
- Strict: ['Enabled']. A strict security posture absolutely requires this rule. At this level, it is assumed that the generated audit logs are being forwarded to a centralized Security Information and Event Management (SIEM) system for real-time analysis and alerting, but the configuration on the endpoint itself remains the same.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for monitoring `/etc/sudoers` and `/etc/sudoers.d/` for write and attribute change access (`-p wa`) are configured. The script should use `auditctl -l` to list active rules. If rules containing `-w /etc/sudoers -p wa` and `-w /etc/sudoers.d -p wa` are found, the script must return the string 'Enabled'. Otherwise, it must return 'Disabled'. The output must contain only this string and nothing else.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which must be 'Enabled'. If the argument is 'Enabled', the script must add the following lines to a new or existing audit rules file in `/etc/audit/rules.d/`: `-w /etc/sudoers -p wa -k scope` and `-w /etc/sudoers.d/ -p wa -k scope`. The script must first check if these exact rules already exist in the loaded configuration to prevent duplication. After ensuring the rules are in a file, it must reload the auditd configuration using `augenrules --load`. The script must return `true` on success and `false` on failure.

