# Ensure auditd packages are installed

Necessity: The Linux Audit daemon (auditd) is the userspace component of the Linux Auditing System. It is responsible for writing audit records to the disk, providing a detailed and tamper-resistant log of security-relevant events on the system. This includes tracking file access, system calls, user authentications, and changes to security configurations. Without auditd, a system administrator or security analyst has no reliable way to perform forensic analysis, detect intrusions, or ensure compliance with security standards like CIS, STIG, or PCI-DSS. The absence of this package creates a critical visibility gap in system security. Auditing and Remediation: The audit script verifies the installation of the 'audit' and 'audit-libs' packages, which are essential for the audit daemon to function. The remediation script uses the system's native package manager (yum/dnf) to install these packages if they are found to be missing. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'installed'. This is a foundational security control with no room for variance. The ability to audit system activity is a non-negotiable prerequisite for any secure environment. Unlike tunable parameters, the presence of the auditing toolset is binary; the system either has this capability or it does not. Therefore, its installation is a baseline requirement for all levels of security hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['installed']` |
| **Moderate** | `['installed']` |
| **Strict** | `['installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'audit' and 'audit-libs' packages are installed. The script should output 'installed' if both packages are present, and 'not installed' otherwise. The output must not contain any extra text or formatting.

## Remediation Script Working

Bash script that accepts a single argument specifying the desired state. If the argument is 'installed', the script should use the system's package manager (e.g., yum or dnf) to install the 'audit' and 'audit-libs' packages. The script must return 'true' if the installation is successful or the packages are already installed, and 'false' otherwise.

