# Ensure audit configuration files owner is configured

The auditd service is a critical component for system security, responsible for logging auditable events. Its configuration files, located in `/etc/audit/`, define what is logged and how. If these files are not owned by the root user, a malicious actor with access to another account could potentially modify them. This could allow the attacker to disable auditing for their activities, change audit rules to ignore certain events, or redirect logs, effectively blinding system administrators and security tools. Such a misconfiguration severely undermines the system's integrity and the ability to perform forensic analysis after a security incident. The audit script verifies that all files in `/etc/audit/` are owned by 'root', confirming that only the superuser can manage the audit configuration. The remediation script uses the `chown` command to correct any ownership discrepancies, restoring control of the audit configuration exclusively to the 'root' user. The recommended state for all security levels (Basic, Moderate, and Strict) is exclusively 'root'. There is no secure alternative; any ownership by a non-root user presents an unacceptable security risk, as it compromises the trustworthiness of the entire system's audit trail.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the ownership of all configuration files located in the `/etc/audit/` directory and its subdirectories. The script must identify any file not owned by 'root'. If all files are owned by 'root', the script must output the string 'root'. If one or more files are owned by a different user, it must output only the username of the first non-compliant file owner found, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which is the desired owner username. The script must use this argument to recursively change the owner of the `/etc/audit/` directory and all its contents to the specified user. The script should also set the group ownership to the same value for consistency. The script must output 'true' on success and 'false' if the `chown` command fails.

