# Ensure successful and unsuccessful attempts to use the usermod command are collected

Necessity: The 'usermod' command is a powerful utility used to modify user account attributes, such as group membership, home directory, and shell. Unauthorized or malicious use of this command can lead to privilege escalation, lateral movement, or denial of service by altering critical user accounts. Auditing its usage is essential for creating a forensic trail, detecting unauthorized account modifications, and ensuring compliance with security policies. Failure to log 'usermod' activity creates a significant visibility gap in security monitoring, making it difficult to investigate security incidents involving account takeovers or insider threats.

Auditing and Remediation: The audit script queries the active 'auditd' rule set to verify the presence of a specific rule that watches the '/usr/sbin/usermod' executable for write and attribute change events ('-p wa'). The remediation script ensures this rule is active and persistent by adding it to the '/etc/audit/rules.d/' directory, which is the standard practice for modern auditd configurations, and then reloads the audit service to apply the change immediately.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Present'. This is a foundational security control with no viable less-secure alternative. Any system aspiring to a baseline level of security must log modifications to user accounts. This control is mandated by security frameworks like the CIS Benchmarks because it directly supports the principles of accountability and detectability. The distinction between security levels does not apply here, as the absence of this rule is considered a critical misconfiguration in any production environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the currently loaded auditd rules for a rule that audits the '/usr/sbin/usermod' command for write and attribute change permissions with the key 'usermod'. The script must output 'Present' if such a rule exists and 'Not Present' otherwise, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument. If the argument is 'Present', the script must add the rule '-w /usr/sbin/usermod -p wa -k usermod' to a new or existing auditd rules file (e.g., /etc/audit/rules.d/usermod.rules) to ensure it persists across reboots. The script should then reload the auditd rules. It must return 'true' on successful addition and 'false' on failure.

