# Ensure unsuccessful file access attempts are collected

Necessity: Monitoring unsuccessful file access attempts is critical for detecting potential security breaches. An attacker attempting to access or modify restricted files will generate these events. Collecting these logs provides a clear audit trail for intrusion detection, forensic analysis, and identifying misconfigured file permissions. Failure to log these events creates a significant visibility gap, allowing unauthorized activity to go unnoticed. Auditing and Remediation: The audit script inspects the currently loaded auditd rules using 'auditctl' to verify that specific rules are active for monitoring failed system calls related to file access (open, creat, etc.). The remediation script modifies the persistent auditd rules file (e.g., /etc/audit/rules.d/access.rules) to either add or remove these rules, ensuring the configuration survives reboots, and then reloads the audit daemon to apply the changes immediately. Recommended State Rationale: Basic: 'Present' is the fundamental recommendation. This level of logging is essential for any baseline security posture and is mandated by security frameworks like the CIS Benchmarks. Moderate: The recommendation remains 'Present'. This is not a graded control; the data is either collected or it is not. A moderately hardened system must have this visibility. Strict: For a strictly hardened system, having these rules 'Present' is non-negotiable. This data is indispensable for advanced threat hunting and incident response where every unauthorized access attempt must be captured and analyzed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for unsuccessful file access attempts are configured for both 32-bit and 64-bit architectures. The script must query the active auditd rules for entries monitoring the 'open', 'openat', 'creat', 'truncate', and 'ftruncate' syscalls that fail with 'EACCES' or 'EPERM' for user IDs 1000 and greater. The script should output 'Present' if all required rules are found, and 'Absent' otherwise. The output must contain only the resulting string.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Present' or 'Absent'. If the argument is 'Present', the script must add the required auditd rules for logging unsuccessful file access attempts (for both EACCES and EPERM errors on 32-bit and 64-bit syscalls) to a rule file in '/etc/audit/rules.d/' and then run 'augenrules --load' to apply them. If the argument is 'Absent', the script must remove these specific rules. The script must return 'true' on successful application or removal, and 'false' on failure.

