# Ensure audit configuration files mode is configured

Necessity: The auditd configuration files in `/etc/audit/` define the rules for the Linux Audit Daemon, which logs security-relevant events on the system. If these files are world-writable or world-readable, an unauthorized user could modify the rules to stop logging their malicious activities, effectively erasing their tracks. They could also read the files to understand the system's monitoring capabilities. Securing these files is critical to maintaining the integrity and confidentiality of the system's audit trail. Failure to do so creates a high risk of audit evasion and reconnaissance by attackers. Auditing and Remediation: The audit script systematically checks every file within the `/etc/audit/` directory to ensure its permissions are not more permissive than the recommended '0640' mode. The remediation script uses the `chmod` command to enforce a specific, secure file mode (passed as an argument) on all these configuration files, thereby restricting access to only authorized users. Recommended State Rationale: Basic: ['0640'] - This state sets read/write permissions for the owner (root) and read-only permissions for the group (root), with no permissions for other users. It is the widely accepted baseline standard (e.g., in CIS benchmarks) for preventing unauthorized modification or viewing of audit rules. Modret: ['0640'] - The moderate recommendation remains '0640' as it provides a strong security posture that aligns with established best practices, balancing security with operational needs where administrators in the root group might need to inspect configurations. Strict: ['0600'] - This is the most secure state, restricting all access (read and write) exclusively to the owner (root). This enforces the principle of least privilege to its fullest extent for these files, ensuring that only the superuser account can read or alter the system's audit strategy, which is optimal for high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0640']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the file permissions for all files located in `/etc/audit/` and its subdirectories. The script should determine if any file has permissions more permissive than '0640'. If all files have permissions of '0640' or stricter, the script should output the string 'compliant'. If any file has permissions more permissive than '0640', it should output the string 'non-compliant'. The output must be only one of these two strings.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired file mode in octal format (e.g., '0640'). The script must recursively find all files within the `/etc/audit/` directory and apply the specified mode to them using the `chmod` command. The script should output the string 'true' upon successful completion of all operations, and 'false' if any error occurs.

