# Ensure audit log files owner is configured

Necessity: The ownership of audit log files is critical for maintaining the integrity of system security records. If these files are owned by a non-root user, it becomes possible for an unauthorized user or a compromised service account to tamper with, delete, or otherwise alter the logs. This would allow an attacker to cover their tracks, rendering forensic analysis impossible and undermining the entire audit system. Setting the owner to 'root' ensures that only privileged processes can manage the log files, protecting them from unauthorized modification.

Auditing and Remediation: The audit script verifies the current ownership of the audit log file as defined in the auditd configuration. The remediation script corrects any misconfiguration by using the 'chown' command to reset the file's owner to a secure, specified user, which should always be 'root'.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly set to 'root'. This is an absolute security requirement, not a configurable gradient. Any ownership other than 'root' presents a severe security risk. This recommendation aligns with security standards like the CIS Benchmarks, which mandate that sensitive system files, especially audit logs, must be owned by the root user to prevent tampering and ensure the non-repudiation of the recorded events.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies the active audit log file by parsing the 'log_file' parameter from '/etc/audit/auditd.conf'. The script should then use the 'stat -c "%U"' command on that file to determine its owner. The script must output only the owner's username, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired owner's username. The script must parse the 'log_file' parameter from '/etc/audit/auditd.conf' to find the target log file and then use the 'chown' command to set its owner to the provided argument. The script must output 'true' upon successful completion or 'false' if it fails.

