# Ensure events that modify user/group information are collected

Necessity: Monitoring events that modify user and group information is critical for security and system integrity. Files like `/etc/passwd`, `/etc/shadow`, `/etc/group`, and `/etc/gshadow` are the core of user identity management on Linux systems. Unauthorized modifications to these files can lead to the creation of illicit accounts, privilege escalation, or denial of service for legitimate users. Auditing these changes provides a clear record of who is modifying identity information, which is essential for forensic analysis and detecting security breaches.

Auditing and Remediation: The audit script inspects the currently loaded `auditd` rules to verify that watches are in place for any write or attribute modification (`-p wa`) attempts on the critical user and group information files. The remediation script automates the process of enforcing this control. When set to 'enabled', it adds the necessary rules to the `auditd` configuration, ensuring that all modifications are logged. When 'disabled', it removes them.

Recommended State Rationale: 
Basic: `['enabled']` - This is a fundamental security control. Even a basic security posture requires logging modifications to identity files to detect unauthorized changes.
Moderate: `['enabled']` - A moderate security posture builds on the basic requirements, and this control remains essential. There is no middle ground; logging should be active.
Strict: `['enabled']` - For a strict security environment, comprehensive and non-negotiable logging of all identity-related changes is mandatory. This control is binary—it is either on or off—and for any level of security hardening, it must be on. Therefore, 'enabled' is the only appropriate recommendation across all levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the active auditd rules include watches for write and attribute changes on the following files: /etc/group, /etc/passwd, /etc/gshadow, /etc/shadow, and /etc/security/opasswd. The script must use `auditctl -l` to list the rules and verify the presence of configurations equivalent to `-w /etc/group -p wa`, `-w /etc/passwd -p wa`, `-w /etc/gshadow -p wa`, `-w /etc/shadow -p wa`, and `-w /etc/security/opasswd -p wa`. The script must output `true` if all specified rules are found, and `false` otherwise. The output must only be the boolean value.

## Remediation Script Working

Bash script that accepts one positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add the following five rules to a dedicated file in `/etc/audit/rules.d/`: `-w /etc/group -p wa -k user-group-modification`, `-w /etc/passwd -p wa -k user-group-modification`, `-w /etc/gshadow -p wa -k user-group-modification`, `-w /etc/shadow -p wa -k user-group-modification`, and `-w /etc/security/opasswd -p wa -k user-group-modification`. If the argument is 'disabled', the script must remove these specific rules. After modifying the rules file, the script must trigger a reload of all auditd rules. The script must return `true` on success and `false` on failure.

