# Ensure events that modify user/group information are collected

Necessity: Monitoring events that modify user and group information is critical for system security. Files such as /etc/passwd, /etc/shadow, and /etc/group are the foundation of user identity and access control on a Linux system. Unauthorized modifications to these files could lead to the creation of rogue accounts, privilege escalation, or denial of service for legitimate users. Failure to log these changes eliminates the ability to detect and investigate such compromises, leaving the system vulnerable to persistent threats. Auditing and Remediation: The audit script inspects the currently active auditd rules to verify that file system watches are in place for the five critical user/group information files. It specifically looks for rules that monitor for write access or attribute changes (-p wa) and are tagged with a specific key (-k identity) for easy identification. The remediation script ensures these rules are permanently configured by writing them to a file in /etc/audit/rules.d/ and then uses the 'augenrules' command to compile all rule files and load the result into the kernel's audit subsystem. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Present'. This is a foundational security control with no meaningful intermediate state; the rules are either correctly configured or they are not. Basic: 'Present' is required to meet fundamental security compliance standards (e.g., CIS Benchmarks). Moderate: This level reinforces the necessity of the Basic state, as it's a non-negotiable best practice. Strict: In a strict environment, the presence and immutability of these rules are mandatory. The focus is on ensuring the control is active and that the resulting logs are protected and regularly reviewed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for monitoring user/group information files (/etc/group, /etc/passwd, /etc/gshadow, /etc/shadow, /etc/security/opasswd) with the key 'identity' are all present. The script should query the currently loaded rules using 'auditctl -l'. If all five required rules are found, it must output only the string 'Present'. If any rule is missing, it must output only the string 'Absent'.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Present'. If the argument is 'Present', the script must add the following lines to a new or existing rule file within '/etc/audit/rules.d/': '-w /etc/group -p wa -k identity', '-w /etc/passwd -p wa -k identity', '-w /etc/gshadow -p wa -k identity', '-w /etc/shadow -p wa -k identity', and '-w /etc/security/opasswd -p wa -k identity'. After adding the rules, it must reload the auditd configuration using 'augenrules --load'. The script must return 'true' on successful completion or 'false' if any step fails.

