# Ensure sudo log file exists

Necessity: Enabling a dedicated sudo log file is critical for security and compliance as it creates a detailed audit trail of all commands executed with elevated privileges. This log is essential for monitoring administrative activity, investigating security incidents, and detecting potential misuse or unauthorized privilege escalation. Without it, a significant blind spot exists, making it difficult to determine who did what on a system.

Auditing and Remediation: The audit script inspects the sudoers configuration files (`/etc/sudoers` and includes in `/etc/sudoers.d/`) to verify if a `logfile` directive is present and returns its value. The remediation script adds this directive, creating a new, separate configuration file in `/etc/sudoers.d/` to avoid modifying the main `sudoers` file directly. This ensures that all sudo command executions, including inputs and outputs if `log_input` and `log_output` are also enabled, are logged to a specified file.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is to configure a dedicated log file, such as `/var/log/sudo.log`. The path itself does not inherently offer different levels of security. The crucial step is establishing the log's existence. The distinction between hardening levels depends on subsequent operational controls: Basic security is achieved by simply creating the log. Moderate and Strict levels would build upon this by implementing log rotation, ensuring appropriate permissions on the log file, and forwarding logs to a centralized Security Information and Event Management (SIEM) system for monitoring, alerting, and long-term retention.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/var/log/sudo.log']` |
| **Moderate** | `['/var/log/sudo.log']` |
| **Strict** | `['/var/log/sudo.log']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the sudo configuration for a defined log file. The script should parse the effective sudoers configuration (from `/etc/sudoers` and files in `/etc/sudoers.d/`) to find the `logfile` setting using a command like `sudo grep -rE '^\s*Defaults\s+logfile=' /etc/sudoers /etc/sudoers.d/`. It must output only the path of the configured log file (e.g., `/var/log/sudo.log`). If no log file is explicitly defined, it must output the string 'Not configured'.

## Remediation Script Working

Bash script that configures the sudo log file. The script must accept one positional command-line argument: the full path to the desired log file. The script should create a new configuration file in `/etc/sudoers.d/` containing the line `Defaults logfile=<path>`, where `<path>` is the provided argument. It must set the file permissions to `0440` and ensure the parent directory exists. The script must output `true` on successful configuration and `false` on failure.

