# Ensure audit tools mode is configured

Necessity: The audit tools are critical for monitoring system activity and detecting security breaches. If an attacker gains the ability to modify, execute, or disable these tools, they could erase their tracks, disable logging, and operate undetected. Restricting file permissions ensures that only authorized administrative accounts (i.e., root) can manage the auditing subsystem, preserving the integrity of security logs and forensic data. Misconfiguration risks a complete loss of system accountability.

Auditing and Remediation: The audit script systematically verifies the octal permission modes for each of the core auditd executables. The remediation script uses the `chmod` command to enforce a specified set of permissions on these same files, aligning them with the defined security policy and locking down access.

Recommended State Rationale:
- Basic ('0750'): This state aligns with CIS (Center for Internet Security) benchmarks, granting read, write, and execute permissions only to the file's owner (root), and read/execute permissions to the group (root). It effectively prevents any non-privileged user from tampering with the audit system.
- Moderate ('0750'): This level maintains the widely-accepted industry best practice, as '0750' provides a robust security posture that is sufficient for most production environments.
- Strict ('0700'): This is the most secure configuration, removing all permissions for group members and others. It ensures that only the root user account itself can read or execute the audit binaries. This strictly adheres to the principle of least privilege, minimizing the attack surface by eliminating any risk of misuse through compromised accounts that might share the root group.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0750']` |
| **Moderate** | `['0750']` |
| **Strict** | `['0700']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the file permissions for the core audit binaries: `/sbin/auditctl`, `/sbin/aureport`, `/sbin/ausearch`, `/sbin/autrace`, `/sbin/auditd`, `/sbin/audispd`, and `/sbin/augenrules`. The script should use the `stat -c "%a"` command for each file and output a single, comma-separated string of the octal modes, e.g., '750,750,750,750,750,750,750'. The script must only return this string without any headers or extra text.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired file mode in octal format (e.g., '0750'). The script must apply this mode to the following audit tool binaries using the `chmod` command: `/sbin/auditctl`, `/sbin/aureport`, `/sbin/ausearch`, `/sbin/autrace`, `/sbin/auditd`, `/sbin/audispd`, and `/sbin/augenrules`. The script must return 'true' on successful completion of all operations, and 'false' if any `chmod` operation fails.

