# Ensure login and logout events are collected

Necessity: Monitoring login and logout events is critical for security forensics, incident response, and compliance. These events provide a detailed record of user access, helping to identify unauthorized login attempts, track user activity, and establish an audit trail. The files /var/log/faillog, /var/log/lastlog, and /var/log/tallylog contain sensitive information about successful and failed logins. Without auditing, any malicious modification or deletion of these files could go unnoticed, effectively blinding security teams to unauthorized access and erasing intruder tracks. Auditing and Remediation: The audit script verifies that the auditd daemon is configured to monitor /var/log/faillog, /var/log/lastlog, and /var/log/tallylog for any write or attribute change operations. The remediation script creates and applies the necessary auditd rules to ensure that any modification to these critical files is logged, providing an immutable record for investigation. Recommended State Rationale: Basic: ['Enabled']. This is the minimum requirement for a secure system. Enabling these rules aligns with security best practices and benchmarks (e.g., CIS) to ensure a baseline of accountability. Moderate: ['Enabled']. There is no effective intermediate state for this control. The rules are either present and functioning or they are not. The 'Enabled' state is required for adequate security visibility. Strict: ['Enabled']. For this specific control, the 'Enabled' state represents the highest level of security. The rules are binary; they either collect the necessary event data or they don't. All hardening levels mandate that this data collection is active.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd service has rules to monitor the files /var/log/faillog, /var/log/lastlog, and /var/log/tallylog for write and attribute change access (-p wa). The script should parse the output of 'auditctl -l' to verify the presence of all three rules. It must return 'true' if all required rules are present and 'false' otherwise, with no extra text.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If 'enabled', the script must add the following lines to an auditd rule file (e.g., /etc/audit/rules.d/logins.rules): '-w /var/log/faillog -p wa -k logins', '-w /var/log/lastlog -p wa -k logins', and '-w /var/log/tallylog -p wa -k logins'. It must then reload the audit rules. If 'disabled', it must remove these specific rules. The script must return 'true' on successful application or 'false' on failure.

