# Ensure audit log files group owner is configured

The necessity of this setting is to protect the integrity of audit logs. Audit logs are critical for forensic analysis and detecting unauthorized activity. If non-privileged users can modify or delete these logs, an attacker could cover their tracks, rendering the audit trail useless. Misconfiguration poses a high risk of compromising system accountability and security monitoring. The audit script checks the `log_group` parameter within `/etc/audit/auditd.conf` to verify the configured group owner for new log files. The remediation script directly modifies this file to enforce the desired group ownership. The recommended state for all levels (Basic, Moderate, and Strict) is 'root'. This is based on the principle of least privilege. By setting the group to 'root', access to the audit logs is restricted to only the superuser, providing the strongest possible protection against tampering by other system users. There is no security benefit to using a less restrictive group, making 'root' the universal best practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that parses the `/etc/audit/auditd.conf` file. The script must locate the `log_group` parameter and output only its configured value, trimming any leading/trailing whitespace or comments. If the parameter is not found, the script should return an empty string.

## Remediation Script Working

Bash script that accepts a single string value (the group name) as a positional command-line argument. The script must modify the `/etc/audit/auditd.conf` file to set the `log_group` parameter to the provided value. If the parameter already exists, it should be updated; if it does not exist, it should be added. The script must return `true` upon successful modification and `false` on failure.

