# Ensure session initiation information is collected

Necessity: Collecting session initiation information is critical for security monitoring and forensic analysis. The auditd service can log all attempts to start a user session, including successful and failed attempts, by monitoring access to files like utmp, wtmp, and btmp. This data allows administrators to track user activity, detect unauthorized access attempts, and establish a timeline of events during a security incident investigation. Failure to log this information creates a significant visibility gap, allowing an attacker to access a system and remove traces of their entry.

Auditing and Remediation: The audit script verifies that the auditd ruleset is actively configured to watch the key session-related files for write access and attribute changes. The remediation script adds these specific rules to the auditd configuration, ensuring that any modification to these files is recorded in the audit logs, and then reloads the rule set to apply the changes immediately.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. This is a foundational security control with no acceptable less-secure alternative. Any system that is part of a secure environment must have this logging enabled. The distinction between hardening levels does not apply here, as the absence of this logging is a critical failure regardless of other security measures in place. Therefore, the only compliant state is 'Enabled'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if auditd rules for collecting session initiation information are configured. The script must inspect the loaded audit rules for lines matching the patterns for '/var/run/utmp', '/var/log/wtmp', and '/var/log/btmp' with 'wa' permissions and a key like 'session' or 'logins'. The script must output 'Enabled' if all required rules are present and 'Disabled' otherwise. The output must contain only the state value.

## Remediation Script Working

Bash script that accepts one argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the following rules to a persistent auditd configuration file in /etc/audit/rules.d/: '-w /var/run/utmp -p wa -k session', '-w /var/log/wtmp -p wa -k logins', and '-w /var/log/btmp -p wa -k logins'. It should avoid creating duplicate entries. If the argument is 'Disabled', it must remove these specific rules. The script must then reload the auditd rules and output 'true' on success or 'false' on failure.

