# Ensure events that modify the sudo log file are collected

Necessity: The sudo log file contains a record of all commands executed with elevated privileges. Monitoring this file for modifications is critical for security because an attacker who gains administrative access will likely attempt to alter or delete these logs to cover their tracks. This auditd rule ensures that any write access or attribute modification to the log file is recorded by the kernel's audit system, providing a high-integrity trail for forensic analysis and detecting tampering attempts. 

Auditing and Remediation: The audit script inspects the currently loaded kernel audit rules via `auditctl` to verify that a rule is actively monitoring the sudo log file. The remediation script ensures this rule is persistent by adding it to the auditd rules files in `/etc/audit/rules.d/`, which are processed by `augenrules` to build the master `audit.rules` file, and then reloads the rules to make them active. 

Recommended State Rationale: 
- Basic: ['present'] - It is a fundamental security practice to monitor critical log files. Any modification to the sudo log outside of normal service operation is a significant security event that must be captured. 
- Moderate: ['present'] - There is no effective intermediate state for this control. The integrity of privilege escalation logs is essential for accountability and intrusion detection in any moderately secure environment. 
- Strict: ['present'] - In a high-security environment, ensuring the immutability and integrity of audit trails is paramount. This rule is a non-negotiable component of a robust logging and auditing subsystem.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if an auditd rule exists to monitor for write or attribute change events on the '/var/log/sudo.log' file. The script should use `auditctl -l` and `grep` to search for a rule matching the pattern '-w /var/log/sudo.log -p wa'. It must return only the string 'present' if the rule is found, or 'absent' if it is not.

## Remediation Script Working

bash script that accepts a single argument, 'present' or 'absent', to manage the auditd rule for monitoring the sudo log file. If the argument is 'present', the script must add the rule '-w /var/log/sudo.log -p wa -k sudo_log_events' to '/etc/audit/rules.d/audit.rules' if it's not already there and then reload the auditd rules using `augenrules --load`. If the argument is 'absent', it should remove the rule. The script must return 'true' on success or 'false' on failure.

